CVE-2025-1756 MongoDB Shell may be susceptible to local privilege escalation in Windows
Local attackers can escalate privileges on Windows systems by placing a crafted file in a specific directory, affecting MongoDB Shell users.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-1756?
CVE-2025-1756 is a high-severity vulnerability in Redhat Enterprise Linux Eus, published on 27 Feb 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
mongosh may be susceptible to local privilege escalation under certain conditions potentially enabling unauthorized actions on a user's system with elevated privilege, when a crafted file is stored in C:\node_modules\. This issue affects mongosh prior to 2.3.0
Weakness: CWE-426
Which versions are affected by CVE-2025-1756?
2 open source packages ship an affected version, including mongosh. It affects 13 products.
| Package | Affected | Fixed in |
|---|---|---|
mongosh npm | All versions | 2.3.0 |
mongosh npm | All versions | 2.3.0 |
Products include Mongodb Mongosh, Redhat Codeready Linux Builder Eus, Redhat Codeready Linux Builder for Arm64 Eus, Redhat Codeready Linux Builder for Ibm Z Systems Eus, Redhat Codeready Linux Builder for Power Little Endian Eus, Redhat Enterprise Linux Eus and 7 more.
How do I fix CVE-2025-1756?
Upgrade mongosh to 2.3.0 or later.
Is CVE-2025-1756 being exploited?
There is no known exploitation of CVE-2025-1756 in the wild and no public exploit code.
Other vulnerabilities in Redhat Enterprise Linux Eus
Sources
Also known as GHSA-f5w3-73h4-jpcm.