Description
mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method.
NVD enrichment (full description, CVSS vector, CWEs) has not completed for this CVE yet — shown above is the CISA KEV short description only.
Scoring
- CVSS: Not yet available
- EPSS exploitation probability: Not yet available
- EPSS percentile: Not yet available
CISA KEV status
- Added to KEV: 2021-12-10
- Remediation due date: 2022-06-10
- Known ransomware campaign use: Unknown
More from MongoDB
- CVE-2025-14847 — MongoDB and MongoDB Server