CVE-2025-1756: MongoDB Mongosh

High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days.

mongosh may be susceptible to local privilege escalation under certain conditions potentially enabling unauthorized actions on a user's system with elevated privilege, when a crafted file is stored in C:\node_modules\. This issue affects mongosh prior to 2.3.0

Affected products

• MongoDB Mongosh: before 2.3.0 (fixed in 2.3.0)
• Red Hat Codeready Linux Builder Eus: version 9.4 only
• Red Hat Codeready Linux Builder For ARM64 Eus: version 9.4_aarch64 only
• Red Hat Codeready Linux Builder For IBM Z Systems Eus: version 9.4_s390x only
• Red Hat Codeready Linux Builder For Power Little Endian Eus: version 9.4_ppc64le only
• Red Hat Enterprise Linux Eus: version 9.4 only
• Red Hat Enterprise Linux For Arm 64: version 9.4_aarch64 only
• Red Hat Enterprise Linux For Arm 64 Eus: version 9.4_aarch64 only
• Red Hat Enterprise Linux For IBM Z Systems: version 9.4_s390x only
• Red Hat Enterprise Linux For IBM Z Systems Eus: version 9.4_s390x only
• Red Hat Enterprise Linux For Power Little Endian Eus: version 9.4_ppc64le only
• Red Hat Enterprise Linux Server Aus: version 9.4 only
• Red Hat Enterprise Linux Update Services For SAP Solutions: version 9.4 only

Published 2025-02-27. Last modified 2026-06-17.