CVE ID:

CVE-2025-1755

Title:

MongoDB Compass may be susceptible to local privilege escalation in Windows

Description:
MongoDB Compass may be susceptible to local privilege escalation under certain conditions potentially enabling unauthorized actions on a user's system with elevated privileges, when a crafted file is stored in C:\node_modules\. This issue affects MongoDB Compass prior to 1.42.1

CVSS Score:

7.5 - https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H 

List all affected product versions:
MongoDB Compass prior to 1.42.1

CWE:

CWE-426: Untrusted Search Path

Is a fixed version available:

Yes

How was the issue found, Internally/Externally:

Externally

Required Configuration:
Only environments with Windows as the underlying operating system is affected by this issue

Credit:

T. Doğa Gelişli