CVE-2025-1756
CVSS 3.1 Score 7.5 of 10 (high)
Details
Published Feb 27, 2025
CWE ID 426
Summary
CVE-2025-1756 is a local privilege escalation vulnerability affecting mongosh, a MongoDB shell client, prior to version 2.3.0. Under specific conditions, mongosh may allow an attacker to store a crafted file in the C:\node_modules\ directory, potentially enabling unauthorized actions with elevated privileges on the user's system. This issue poses a significant security risk, as it could lead to serious consequences if exploited successfully. It is important for users to upgrade to the latest version of mongosh to mitigate this vulnerability.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Vendors
- MongoDB Inc