GHSA-973h-3x6p-qg37

Source

https://github.com/advisories/GHSA-973h-3x6p-qg37

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/02/GHSA-973h-3x6p-qg37/GHSA-973h-3x6p-qg37.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-973h-3x6p-qg37

Aliases

CVE-2025-1692

Published

2025-02-27T15:31:51Z

Modified

2025-02-27T17:42:32Z

Severity

6.3 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H CVSS Calculator

Summary

MongoDB Shell may be susceptible to control character injection via pasting

Details

The MongoDB Shell may be susceptible to control character injection where an attacker with control of the user’s clipboard could manipulate them to paste text into mongosh that evaluates arbitrary code. Control characters in the pasted text can be used to obfuscate malicious code. This issue affects mongosh versions prior to 2.3.9.

Database specific

{
    "cwe_ids":  [
        "CWE-150"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2025-02-27T17:15:53Z",
    "nvd_published_at":  "2025-02-27T13:15:11Z",
    "severity":  "MODERATE"
}

References

Affected packages

npm / mongosh

Package

Name: mongosh; View open source insights on deps.dev
Purl: pkg:npm/mongosh

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.3.9

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/02/GHSA-973h-3x6p-qg37/GHSA-973h-3x6p-qg37.json"