mongodb-js/mongosh · Security
mongosh vulnerable to local privilege escalation
- GHSA ID
- GHSA-f5w3-73h4-jpcm
- CVE ID
- CVE-2025-1756
- Severity
- high
- Published
- Updated
- CVSS
- 7.5 · CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
- CVSS v3
- 7.5 · CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
Description
mongosh may be susceptible to local privilege escalation under certain conditions potentially enabling unauthorized actions on a user's system with elevated privilege, when a crafted file is stored in C:\node_modules. This issue affects mongosh prior to 2.3.0.
CWEs
- CWE-426 · Untrusted Search Path