Control Character Injection Vulnerability in MongoDB Shell

CVE-2025-1692

What is CVE-2025-1692?

The MongoDB Shell is vulnerable to a control character injection, which can be exploited by an attacker who gains access to a user's clipboard. This vulnerability allows malicious users to paste obfuscated code into the MongoDB Shell (mongosh), potentially leading to arbitrary code execution. The issue specifically affects versions of mongosh before 2.3.9, making it critical for users to upgrade to secure their environments against such injection threats.

References