Description
mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method. A misuse of the `vm` dependency to perform `exec` commands in a non-safe environment.
Remediation
References
https://snyk.io/vuln/SNYK-JS-MONGOEXPRESS-473215
Related Vulnerabilities
CVE-2021-23414 Vulnerability in npm package video.js
CVE-2022-41253 Vulnerability in maven package org.jenkins-ci.plugins:cons3rt
CVE-2020-13822 Vulnerability in maven package org.webjars.npm:elliptic
CVE-2018-16481 Vulnerability in npm package html-pages
CVE-2020-24750 Vulnerability in maven package com.fasterxml.jackson.core:jackson-databind