CVE-2025-1691: 
JavaScript vulnerability analysis and mitigation

CVE-2025-1691 affects the MongoDB Shell (mongosh) and was disclosed on February 27, 2025. The vulnerability is a control character injection issue in the mongosh autocomplete feature that affects versions prior to 2.3.9. The vulnerability requires user interaction and is only exploitable when mongosh is connected to a cluster that is partially or fully controlled by an attacker (MongoDB Issue, NVD).

The vulnerability is classified as CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'). It has been assigned a CVSS v3.1 base score of 7.6 (HIGH) with the vector string CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H, indicating network accessibility, high attack complexity, high privileges required, user interaction required, and high impacts on confidentiality, integrity, and availability (MongoDB Issue).

If successfully exploited, an attacker can use the autocompletion feature to input and run obfuscated malicious text. The high CVSS score indicates potential severe impacts on system confidentiality, integrity, and availability when successfully exploited (MongoDB Issue).

Users should upgrade to MongoDB Shell version 2.3.9 or later to address this vulnerability (MongoDB Issue).