CVE-2025-1756

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-1756
mongosh may be susceptible to local privilege escalation under certain conditions potentially enabling unauthorized actions on a user's system with elevated privilege, when a crafted file is stored in C:\node_modules\. This issue affects mongosh prior to 2.3.0

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 0.8 / Impact : 6.0

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://jira.mongodb.org/browse/MONGOSH-2028 Issue Tracking Vendor Advisory
https://access.redhat.com/errata/RHSA-2025:1756 Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:mongodb:mongosh:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:a:redhat:codeready_linux_builder_eus:9.4:*:*:*:*:*:*:*
cpe:2.3:a:redhat:codeready_linux_builder_for_arm64_eus:9.4_aarch64:*:*:*:*:*:*:*
cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems_eus:9.4_s390x:*:*:*:*:*:*:*
cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian_eus:9.4_ppc64le:*:*:*:*:*:*:*
cpe:2.3:a:redhat:enterprise_linux_update_services_for_sap_solutions:9.4:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:9.4:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_arm_64:9.4_aarch64:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:9.4_aarch64:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:9.4_s390x:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:9.4_s390x:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:9.4_ppc64le:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:9.4:*:*:*:*:*:*:*
History

17 Jun 2026, 08:39

Type Values Removed Values Added
References () https://jira.mongodb.org/browse/MONGOSH-2028 - Vendor Advisory, Issue Tracking () https://jira.mongodb.org/browse/MONGOSH-2028 - Issue Tracking, Vendor Advisory

09 Apr 2025, 14:07

Type Values Removed Values Added
First Time Redhat enterprise Linux Eus
Redhat codeready Linux Builder Eus
Redhat enterprise Linux Update Services For Sap Solutions
Redhat codeready Linux Builder For Power Little Endian Eus
Redhat
Redhat enterprise Linux For Arm 64
Redhat enterprise Linux For Power Little Endian Eus
Mongodb mongosh
Mongodb
Redhat enterprise Linux For Ibm Z Systems
Redhat enterprise Linux For Arm 64 Eus
Redhat enterprise Linux For Ibm Z Systems Eus
Redhat codeready Linux Builder For Arm64 Eus
Redhat enterprise Linux Server Aus
Redhat codeready Linux Builder For Ibm Z Systems Eus
References () https://jira.mongodb.org/browse/MONGOSH-2028 - () https://jira.mongodb.org/browse/MONGOSH-2028 - Vendor Advisory, Issue Tracking
References () https://access.redhat.com/errata/RHSA-2025:1756 - () https://access.redhat.com/errata/RHSA-2025:1756 - Third Party Advisory
Summary
  • (es) Mongosh puede ser susceptible a una escalada de privilegios locales en determinadas condiciones, lo que podría permitir acciones no autorizadas en el sistema de un usuario con privilegios elevados, cuando un archivo manipulado se almacena en C:\node_modules\. Este problema afecta a mongosh antes de la versión 2.3.0.
CPE cpe:2.3:o:redhat:enterprise_linux_server_aus:9.4:*:*:*:*:*:*:*
cpe:2.3:a:redhat:codeready_linux_builder_for_arm64_eus:9.4_aarch64:*:*:*:*:*:*:*
cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems_eus:9.4_s390x:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:9.4_ppc64le:*:*:*:*:*:*:*
cpe:2.3:a:redhat:enterprise_linux_update_services_for_sap_solutions:9.4:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:9.4:*:*:*:*:*:*:*
cpe:2.3:a:redhat:codeready_linux_builder_eus:9.4:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_arm_64:9.4_aarch64:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:9.4_s390x:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:9.4_s390x:*:*:*:*:*:*:*
cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian_eus:9.4_ppc64le:*:*:*:*:*:*:*
cpe:2.3:a:mongodb:mongosh:*:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:9.4_aarch64:*:*:*:*:*:*:*

27 Feb 2025, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-02-27 16:15

Updated : 2026-06-17 08:39

NVD link : CVE-2025-1756

Mitre link : CVE-2025-1756

CVE.ORG link : CVE-2025-1756

JSON object : View

Products Affected

redhat

  • enterprise_linux_server_aus
  • enterprise_linux_for_ibm_z_systems_eus
  • codeready_linux_builder_for_ibm_z_systems_eus
  • enterprise_linux_eus
  • enterprise_linux_for_power_little_endian_eus
  • enterprise_linux_for_arm_64_eus
  • codeready_linux_builder_for_power_little_endian_eus
  • codeready_linux_builder_eus
  • enterprise_linux_for_ibm_z_systems
  • enterprise_linux_update_services_for_sap_solutions
  • codeready_linux_builder_for_arm64_eus
  • enterprise_linux_for_arm_64

mongodb

  • mongosh
CWE
CWE-426

Untrusted Search Path