- Vendor / Project
- MongoDB
- Product
- mongo-express
- Date added
- Dec 10, 2021
- Due date
- Jun 10, 2022
- Known ransomware use
- Unknown
- CWEs
- —
Description
mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method.
Required action
Apply updates per vendor instructions.