PatchTheCVECVE-2025-1693: The MongoDB Shell may be susceptible to control character injection where an attacker with control over the da
CVE-2025-1693 is a low-severity flaw (CVSS 3.9) affecting mongosh. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
The MongoDB Shell may be susceptible to control character injection where an attacker with control over the database cluster contents can inject control characters into the shell output. This may result in the display of falsified messages that appear to originate from mongosh or the underlying operating system, potentially misleading users into executing unsafe actions. The vulnerability is exploitable only when mongosh is connected to a clust
Why this priority
- No elevated risk signals yet
A fixed release or distro patch exists.
Risk facts
| CVSS score | 3.9 (Low) |
| Attack vector | Network (remote) |
| Attack complexity | High |
| Privileges needed | High |
| User interaction | Required |
| EPSS exploit chance | 0.2% (top 87%) |
| CISA exploited list | No |
| Weakness | CWE-150 |
| Published | 2025-02-27 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2025-1693?
mongosh: upgrade to 2.3.9. Exact commands for each OS are on this page.
Is CVE-2025-1693 being exploited?
CVE-2025-1693 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2025-1693 affect?
CVE-2025-1693 affects mongosh. Severity is low (CVSS 3.9). The MongoDB Shell may be susceptible to control character injection where an attacker with control over the database cluster contents can inject control characters into the shell output. This may result in the display of falsified messages
How urgent is CVE-2025-1693?
Priority 17/100. No elevated risk signals yet.
Software pages
Related CVEs
- CVE-2025-1756 HIGH 7.5 UPGRADE DOWNGRADE mongosh may be susceptible to local privilege escalation under certain conditions potentially enabling unautho
- CVE-2025-1692 MEDIUM 6.3 UPGRADE The MongoDB Shell may be susceptible to control character injection where an attacker with control of the user
- CVE-2025-1691 HIGH 7.6 UPGRADE The MongoDB Shell may be susceptible to control character injection where an attacker with control of the mong