GHSA-hxmg-hm46-cf62
Remote code execution in mongo-express
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | mongodb-query-parser | < 2.0.0 | 2.0.0 |
Details
As written in the advisory (Markdown source, shown as plain text).
mongo-express before 1.0.0 offers support for certain advanced syntax but implements this in an unsafe way. NOTE: this may overlap CVE-2019-10769.
References
External links from the advisory. They lead to third-party sites.