CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2020-24391
Critical (9.8) in mongo-express project mongo-express. EPSS 75% chance of exploitation in the next 30 days. Fixed in mongodb-query-parser 2.0.0.
mongo-express before 1.0.0 offers support for certain advanced syntax but implements this in an unsafe way. NOTE: this may overlap CVE-2019-10769.
Severity
- EPSS
- 75% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
- Published
- Modified
- Record from
- the NVD, synced
Affected
- mongo-express_project:mongo-express
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-hxmg-hm46-cf62 | npm | mongodb-query-parser | <2.0.0 | 2.0.0 |