mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method. A misuse of the `vm` dependency to perform `exec` commands in a non-safe environment.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| mongo-express(npm) | 0 | 0.54.0 | N/A |
CVSS Metrics
