Skip to content
OpenAdvisories

Package · npm

mongodb-query-parser

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Critical 9.8
    CVE-2020-24391 EPSS 75%

    Remote code execution in mongo-express

    mongo-express before 1.0.0 offers support for certain advanced syntax but implements this in an unsafe way. NOTE: this may overlap CVE-2019-10769.

    mongodb-query-parser npm
  • Critical —
    GHSA-97mg-3cr6-3x4c

    Remote Code Execution in mongodb-query-parser

    Versions of `mongodb-query-parser` prior to 2.0.0 are vulnerable to Remote Code Execution. The package fails to sanitize queries, allowing attackers to execute arbitrary code in the system. Parsing the following payload executes `touch test-file`: ```'(functi…

    mongodb-query-parser npm