CVE-2025-1755: MongoDB Compass Privilege Escalation Flaw

CVE-2025-1755 Overview

CVE-2025-1755 is a local privilege escalation vulnerability in MongoDB Compass versions prior to 1.42.1. The flaw stems from an untrusted search path condition [CWE-426] on Windows systems. When a crafted file is placed in C:\node_modules\, MongoDB Compass may load it during execution, leading to unauthorized actions with elevated privileges on the affected user's system. The vulnerability also affects Red Hat Enterprise Linux distributions that package MongoDB Compass. Successful exploitation grants attackers the ability to execute arbitrary code in the context of the Compass process.

Critical Impact
A local attacker with low privileges can escalate to the privileges of the Compass user by placing a malicious module in C:\node_modules\, resulting in full confidentiality, integrity, and availability impact.

Affected Products

MongoDB Compass versions prior to 1.42.1
Microsoft Windows (primary attack surface for C:\node_modules\ path)
Red Hat Enterprise Linux 9 (multiple variants including ARM 64, IBM Z Systems, and SAP Solutions update services)

Discovery Timeline

2025-02-27 - CVE-2025-1755 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-1755

Vulnerability Analysis

CVE-2025-1755 is classified under [CWE-426] Untrusted Search Path. MongoDB Compass is an Electron-based graphical interface for MongoDB built on Node.js. Node.js resolves module imports by traversing a chain of node_modules directories, including drive-root locations such as C:\node_modules\ on Windows. An attacker who can write to C:\node_modules\ can plant a module that Compass loads at runtime. The loaded code executes with the privileges of the user running Compass. Because default Windows configurations may allow non-administrative users to create the C:\node_modules\ directory, an unprivileged local attacker can prepare the payload before a higher-privileged user launches Compass.

Root Cause

The root cause is Node.js module resolution behavior combined with the absence of a hardened module search path in Compass builds prior to 1.42.1. When Compass initializes, the runtime walks parent directories looking for node_modules. The drive root C:\node_modules\ is included in this walk, making it a viable injection point for a hostile package.

Attack Vector

Exploitation requires local access with low privileges and no user interaction beyond the target launching Compass. The attacker creates C:\node_modules\ if it does not exist, places a crafted JavaScript module matching a name Compass attempts to require, and waits for a privileged user session to start the application. The malicious module executes in the process context of Compass, achieving privilege escalation when the launching user holds higher rights than the attacker.

No verified public proof-of-concept exists. Refer to the MongoDB Jira Ticket COMPASS-9058 for vendor-authored technical detail.

Detection Methods for CVE-2025-1755

Indicators of Compromise

Presence of the directory C:\node_modules\ on Windows endpoints where it was not previously provisioned
Unexpected JavaScript files or package.json manifests inside C:\node_modules\ subdirectories
MongoDB Compass processes spawning child processes such as cmd.exe, powershell.exe, or node.exe from unusual paths
File-creation events in C:\node_modules\ by non-administrative user accounts

Detection Strategies

Monitor file-system telemetry for write operations to C:\node_modules\ and enumerate any existing contents across the fleet
Alert on Compass (MongoDBCompass.exe) loading modules from paths outside its install directory
Correlate Compass process launches with subsequent anomalous child-process creation using EDR process-tree data
Baseline expected Compass module load paths and flag deviations

Monitoring Recommendations

Ingest Windows Sysmon Event ID 11 (FileCreate) and Event ID 1 (ProcessCreate) into your SIEM and scope queries to C:\node_modules\
Track installed MongoDB Compass versions across endpoints and flag any build below 1.42.1
Review scheduled tasks, logon scripts, and installer packages that may drop files into C:\node_modules\

How to Mitigate CVE-2025-1755

Immediate Actions Required

Upgrade MongoDB Compass to version 1.42.1 or later on all Windows and Linux endpoints
Apply the Red Hat security update referenced in Red Hat Security Errata RHSA-2025:1755 on affected RHEL 9 systems
Audit Windows hosts for the existence of C:\node_modules\ and remove any unauthorized contents
Restrict write permissions on the root of the C:\ drive to administrators only

Patch Information

MongoDB fixed this issue in Compass 1.42.1. The vendor tracking ticket is MongoDB Jira COMPASS-9058. Red Hat published the corresponding package updates in RHSA-2025:1755 covering enterprise_linux_for_arm_64, enterprise_linux_for_ibm_z_systems, enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions, and enterprise_linux_update_services_for_sap_solutions on the 9.0 stream.

Workarounds

Create C:\node_modules\ as an empty directory owned by Administrators with write access denied to standard users, preventing attacker plant operations
Enforce application allowlisting so that only signed modules from the Compass install directory can be loaded
Remove MongoDB Compass from shared or multi-user workstations until the patched build is deployed

bash

# Windows PowerShell: harden C:\node_modules against untrusted writes
New-Item -Path 'C:\node_modules' -ItemType Directory -Force
icacls 'C:\node_modules' /inheritance:r
icacls 'C:\node_modules' /grant:r 'Administrators:(OI)(CI)F' 'SYSTEM:(OI)(CI)F'
icacls 'C:\node_modules' /deny 'Users:(OI)(CI)(W,M)'