CVE-2025-1755
📋 TL;DR
MongoDB Compass versions before 1.42.1 are vulnerable to local privilege escalation when a malicious file is placed in the C:\node_modules\ directory. This allows attackers with local access to execute arbitrary code with elevated privileges. Only users running vulnerable MongoDB Compass versions on Windows systems are affected.
💻 Affected Systems
- MongoDB Compass
📦 What is this software?
Compass by Mongodb
Enterprise Linux For Ibm Z Systems by Redhat
View all CVEs affecting Enterprise Linux For Ibm Z Systems →
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise where an attacker gains administrative privileges, installs persistent malware, accesses sensitive data, or disables security controls.
Likely Case
Local attacker gains elevated privileges to install software, modify system configurations, or access other user data on the same system.
If Mitigated
Attack limited to user-level access if proper file permissions prevent writing to C:\node_modules\ or if the vulnerability is patched.
🎯 Exploit Status
Exploitation requires local access and ability to write to specific directory. No public exploit code available at this time.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.42.1 or later
Vendor Advisory: https://jira.mongodb.org/browse/COMPASS-9058
Restart Required: No
Instructions:
1. Open MongoDB Compass. 2. Go to Help > Check for Updates. 3. Follow prompts to update to version 1.42.1 or later. 4. Alternatively, download latest version from MongoDB website and install.
🔧 Temporary Workarounds
Restrict C:\node_modules\ directory permissions
windowsSet restrictive permissions on the C:\node_modules\ directory to prevent unauthorized file writes.
icacls C:\node_modules\ /deny Everyone:(OI)(CI)(DE,DC,WD,AD,WA)
🧯 If You Can't Patch
- Remove write permissions from C:\node_modules\ directory for non-administrative users.
- Monitor for suspicious file creation in C:\node_modules\ directory using file integrity monitoring.
🔍 How to Verify
Check if Vulnerable:
Check MongoDB Compass version in Help > About. If version is below 1.42.1, system is vulnerable.Check Version:
mongodb-compass --versionVerify Fix Applied:
Confirm MongoDB Compass version is 1.42.1 or higher in Help > About.📡 Detection & Monitoring
Log Indicators:
- File creation events in C:\node_modules\ directory from non-administrative users
- MongoDB Compass process spawning unexpected child processes
Network Indicators:
- None - this is a local privilege escalation vulnerability
SIEM Query:
EventID=4663 OR EventID=4656 AND ObjectName LIKE 'C:\\node_modules\\%' AND SubjectUserName NOT IN ('SYSTEM', 'Administrators')