What’s Vulnerable › Vulnerabilities

CVE-2020-24391

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 74.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-03-30 · updated 2026-06-17

Description

mongo-express before 1.0.0 offers support for certain advanced syntax but implements this in an unsafe way. NOTE: this may overlap CVE-2019-10769.

Affected products

• mongo-express: through 0.54.0

References

• https://github.com/mongo-express/mongo-express/commit/3a26b079e7821e0e209c3ee0cc2ae15ad467b91a
• https://github.com/mongodb-js/query-parser/issues/16
• https://github.com/mongo-express/mongo-express/commit/3a26b079e7821e0e209c3ee0cc2ae15ad467b91a
• https://github.com/mongodb-js/query-parser/issues/16

Get alerted when CVE-2020-24391 or the next vulnerability affects your stack