Cyber Posture

CVE-2025-1691

High

Published: 27 February 2025

Published
27 February 2025
Modified
22 September 2025
KEV Added
Patch
CVSS Score 7.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
EPSS Score 0.0038 59.4th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-1691 is a high-severity Injection (CWE-74) vulnerability in Mongodb Mongosh. Its CVSS base score is 7.6 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Command and Scripting Interpreter (T1059); ranked in the top 40.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Command and Scripting Interpreter (T1059) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly mitigates CVE-2025-1691 by requiring timely patching and updating of mongosh to version 2.3.9 or later to fix the control character injection flaw.

prevent

Prevents exploitation of the autocomplete feature by enforcing input validation to neutralize control characters and malicious text from attacker-controlled clusters.

detect

Identifies deployments of vulnerable mongosh versions prior to 2.3.9 through regular vulnerability scanning, enabling remediation before exploitation.

MITRE ATT&CK Enterprise TechniquesAI

T1059 Command and Scripting Interpreter Execution
Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.
T1204 User Execution Execution
An adversary may rely upon specific actions by a user in order to gain execution.
Why these techniques?

Vulnerability enables injection and execution of arbitrary commands/text within the mongosh command interpreter (T1059) when the user interacts by pressing tab (T1204).

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

NVD Description

The MongoDB Shell may be susceptible to control character injection where an attacker with control of the mongosh autocomplete feature, can use the autocompletion feature to input and run obfuscated malicious text. This requires user interaction in the form of…

more

the user using ‘tab’ to autocomplete text that is a prefix of the attacker’s prepared autocompletion. This issue affects mongosh versions prior to 2.3.9. The vulnerability is exploitable only when mongosh is connected to a cluster that is partially or fully controlled by an attacker.

Deeper analysisAI

CVE-2025-1691 is a control character injection vulnerability in the MongoDB Shell, known as mongosh. It allows an attacker with control over the mongosh autocomplete feature to inject and execute obfuscated malicious text through the autocompletion mechanism. The issue requires user interaction, specifically pressing the 'tab' key to autocomplete text that matches a prefix prepared by the attacker. This vulnerability affects mongosh versions prior to 2.3.9.

Exploitation is possible only when mongosh is connected to a MongoDB cluster that is partially or fully controlled by the attacker. The attacker needs high privileges (PR:H) on the cluster, network access (AV:N), and must overcome high attack complexity (AC:H), along with tricking the user into required interaction (UI:R). Successful exploitation can result in high impacts to confidentiality, integrity, and availability (C:H/I:H/A:H) with a changed scope (S:C), earning a CVSS v3.1 base score of 7.6. The associated CWE is CWE-74.

Mitigation requires upgrading to mongosh version 2.3.9 or later. Additional details are available in the MongoDB advisory at https://jira.mongodb.org/browse/MONGOSH-2024.

Details

CWE(s)

Affected Products

mongodb
mongosh
≤ 2.3.9

CVEs Like This One

CVE-2025-1692Same product: Mongodb Mongosh
CVE-2025-0755Same vendor: Mongodb
CVE-2026-4358Same vendor: Mongodb
CVE-2026-1849Same vendor: Mongodb
CVE-2026-1848Same vendor: Mongodb
CVE-2025-14847Same vendor: Mongodb
CVE-2026-1847Same vendor: Mongodb
CVE-2026-1850Same vendor: Mongodb
CVE-2026-4148Same vendor: Mongodb
CVE-2026-34041Shared CWE-74

References