CVE-2025-1756
mongosh may be susceptible to local privilege escalation under certain conditions potentially enabling unauthorized actions on a user's system with elevated privilege, when a crafted file is stored in C:\node_modules\. This issue affects mongosh prior to 2.3.0
- Score
- CVSS 3.1 7.8 High
- Status
- Analyzed - cna@mongodb.com
- Published
- 2025-02-27
- Last modified
- 2025-02-27
- Weaknesses
- CWE-426
Affected products
- Mongosh (Mongodb)
- Codeready Linux Builder Eus (Redhat)
- Codeready Linux Builder For Arm64 Eus (Redhat)
- Codeready Linux Builder For Ibm Z Systems Eus (Redhat)
- Codeready Linux Builder For Power Little Endian Eus (Redhat)
- Enterprise Linux Eus (Redhat)
- Enterprise Linux For Arm 64 (Redhat)
- Enterprise Linux For Arm 64 Eus (Redhat)
- Enterprise Linux For Ibm Z Systems (Redhat)
- Enterprise Linux For Ibm Z Systems Eus (Redhat)
- Enterprise Linux For Power Little Endian Eus (Redhat)
- Enterprise Linux Server Aus (Redhat)
- Enterprise Linux Update Services For Sap Solutions (Redhat)
References
- https://jira.mongodb.org/browse/MONGOSH-2028
- https://access.redhat.com/errata/RHSA-2025:1756
