PatchTheCVEmongosh vulnerabilities and fixes
Recent CVEs affecting mongosh, with upgrade or downgrade steps. 4 tracked.
mongosh has 4 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 4. Most recent: 2025-02-27. Highest priority: CVE-2025-1691 (score 34/100).
- CVE-2025-1756 HIGH 7.5 UPGRADE DOWNGRADE mongosh may be susceptible to local privilege escalation under certain conditions potentially enabling unautho
- CVE-2025-1693 LOW 3.9 UPGRADE The MongoDB Shell may be susceptible to control character injection where an attacker with control over the da
- CVE-2025-1692 MEDIUM 6.3 UPGRADE The MongoDB Shell may be susceptible to control character injection where an attacker with control of the user
- CVE-2025-1691 HIGH 7.6 UPGRADE The MongoDB Shell may be susceptible to control character injection where an attacker with control of the mong
FAQ
How do I fix mongosh vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is mongosh being exploited right now?
None of the tracked mongosh CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which mongosh CVE should I patch first?
CVE-2025-1691 currently ranks highest (34/100): The MongoDB Shell may be susceptible to control character injection where an attacker with control of the mong.