GitHub Advisoryadvisory · npm

GHSA-f5w3-73h4-jpcm mongosh vulnerable to local privilege escalation

HIGH Published 2025-02-27 Modified 2025-02-27 Official page ↗
Aliases
CVE-2025-1756
Ecosystem
npm
Packages
mongosh
Severity
High
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
Weaknesses
CWE-426
Reviewed
2025-02-27

Affected packages

• npm mongosh: < 2.3.0 → fixed in 2.3.0

Description

mongosh may be susceptible to local privilege escalation under certain conditions potentially enabling unauthorized actions on a user's system with elevated privilege, when a crafted file is stored in C:\node_modules\. This issue affects mongosh prior to 2.3.0.

Related

Alias · CVE (1)

  • CVE-2025-1756 mongosh may be susceptible to local privilege escalation under certain conditions potentially enabling unauthorized actions on a user's… vulnerability

Weakness · CWE (1)

  • CWE-426 Untrusted Search Path weakness

References