CVE-2025-1756: mongosh vulnerable to local privilege escalation

February 27, 2025

mongosh may be susceptible to local privilege escalation under certain conditions potentially enabling unauthorized actions on a user’s system with elevated privilege, when a crafted file is stored in C:\node_modules. This issue affects mongosh prior to 2.3.0.

References

access.redhat.com/errata/RHSA-2025:1756
github.com/advisories/GHSA-f5w3-73h4-jpcm
github.com/mongodb-js/mongosh
jira.mongodb.org/browse/MONGOSH-2028
nvd.nist.gov/vuln/detail/CVE-2025-1756

Code Behaviors & Features

Detect and mitigate CVE-2025-1756 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →