Skip to main content

Improper Neutralization of Escape, Meta, or Control Sequences

CVE-2025-1692

High
8.8/10

Summary

MongoDB Shell may be susceptible to control character injection, where an attacker with control of the user's clipboard could manipulate them to paste text into mongosh that evaluates arbitrary code. Control characters in the pasted text can be used to obfuscate malicious code. This issue affects mongosh versions prior to 2.3.9.

  • LOW
  • NETWORK
  • HIGH
  • UNCHANGED
  • REQUIRED
  • NONE
  • HIGH
  • HIGH

CWE-150 - Improper Neutralization of Escape, Meta, or Control Sequences

The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as escape, meta, or control character sequences when they are sent to a downstream component.

References

Advisory Timeline

  • Published