mongo-express (npm) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the npm package mongo-express, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (4)

• CVE-2019-10758 — CVSS 9.9 (critical) — actively exploited: mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method. A misuse of the `vm`…
• CVE-2021-21422 — CVSS 8.1 (high): mongo-express is a web-based MongoDB admin interface, written with Node.js and express. 1: As mentioned in this issue…
• CVE-2023-52555 — CVSS 6.1 (medium): In mongo-express 1.0.2, /admin allows CSRF, as demonstrated by deletion of a Collection.
• CVE-2021-23372 — CVSS 4.4 (medium): All versions of package mongo-express are vulnerable to Denial of Service (DoS) when exporting an empty collection as CSV, due to an…