CVE-2025-1756
High
Description
mongosh may be susceptible to local privilege escalation under certain conditions potentially enabling unauthorized actions on a user's system with elevated privilege, when a crafted file is stored in C:\node_modules\. This issue affects mongosh prior to 2.3.0
SeverityHigh
CVSS7.5
Exploit probability—
Product
Mongodb Mongosh
PublishedFeb 27, 2025
First seenFeb 27, 2025
Weakness typeCWE-426CWE-426
How to fix
Update
- mongodb mongosh2.3.0 or later
- mongosh2.3.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mongodb mongosh | v < 2.3.0 | 2.3.0 |
| redhat codeready_linux_builder_eus | 9.4 | — |
| redhat codeready_linux_builder_for_arm64_eus | 9.4_aarch64 | — |
| redhat codeready_linux_builder_for_ibm_z_systems_eus | 9.4_s390x | — |
| redhat codeready_linux_builder_for_power_little_endian_eus | 9.4_ppc64le | — |
| redhat enterprise_linux_update_services_for_sap_solutions | 9.4 | — |
| redhat enterprise_linux_eus | 9.4 | — |
| redhat enterprise_linux_for_arm_64 | 9.4_aarch64 | — |
| redhat enterprise_linux_for_arm_64_eus | 9.4_aarch64 | — |
| redhat enterprise_linux_for_ibm_z_systems | 9.4_s390x | — |
| redhat enterprise_linux_for_ibm_z_systems_eus | 9.4_s390x | — |
| redhat enterprise_linux_for_power_little_endian_eus | 9.4_ppc64le | — |
| redhat enterprise_linux_server_aus | 9.4 | — |
| mongoshnpm | v < 2.3.0 | 2.3.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.