Control Character Injection Vulnerability in MongoDB Shell

CVE-2025-1693

What is CVE-2025-1693?

The MongoDB Shell is vulnerable to control character injection, enabling an attacker who has control over the database cluster contents to inject misleading control characters into the shell output. This manipulation could lead to the display of deceptive messages that may seem to emanate from mongosh or the operating system itself. As a consequence, users could be misled into executing unsafe actions. The vulnerability is present when mongosh connects to a database cluster that is either partially or fully controlled by an attacker, thus posing a significant security risk for database operations.

References