Description
MongoDB Compass may be susceptible to local privilege escalation under certain conditions potentially enabling unauthorized actions on a user's system with elevated privileges, when a crafted file is stored in C:\node_modules\. This issue affects MongoDB Compass prior to 1.42.1
Scores
CVSS v3
7.5
EPSS
0.0005
EPSS Percentile
15.4%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
total
Details
CWE
CWE-426
Status
published
Products (5)
mongodb/compass
< 1.42.1
redhat/enterprise_linux_for_arm_64
9.0_aarch64
redhat/enterprise_linux_for_ibm_z_systems
9.0_s390x
redhat/enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions
9.0_ppc64le
redhat/enterprise_linux_update_services_for_sap_solutions
9.0
Published
Feb 27, 2025
Tracked Since
Feb 18, 2026