CVE-2020-24391: Mongo-Express Project mongo-express

Critical severity, CVSS 9.8. EPSS: 74.5% chance of exploitation in the next 30 days.

mongo-express before 1.0.0 offers support for certain advanced syntax but implements this in an unsafe way. NOTE: this may overlap CVE-2019-10769.

Affected products

• Mongo-Express Project mongo-express: up to and including 0.54.0

Published 2021-03-30. Last modified 2026-06-17.