CVE-2021-21422: Cross-site scripting in mongo-express
Summary
CVE-2021-21422: Cross-site scripting. Affects mongo-express versions < 1.0.0-alpha.4. Fixed in 1.0.0-alpha.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mongo-express is an open-source web-based administrative interface for MongoDB. It provides a user-friendly interface to manage databases, collections, and documents. However, a vulnerability has been discovered in mongo-express that allows for cross-site scripting (XSS) attacks.
Vulnerability Detail
The vulnerability in mongo-express allows for two types of XSS attacks. Firstly, when the content of a cell exceeds the supported size, clicking on a row will display the full unescaped document. This requires admin interaction on the cell. Secondly, data cells identified as media are rendered without being sanitized, allowing for the execution of malicious scripts. An unauthorized user can exploit this vulnerability by sending a large amount of data in a field of a document, which can lead to various attacks such as exporting collections to an attacker-controlled server or dropping databases or collections.
How To Fix
Latest published version: 1.1.0-rc-4 as of 23 Oct 2026
npm install mongo-express@1.1.0-rc-4Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.0.0-alpha.4
This is the first release that contains the fix.
npm install mongo-express@1.0.0-alpha.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version to mitigate the risk of exploitation.
Conclusion
The vulnerability in mongo-express allows for cross-site scripting attacks, which can lead to unauthorized access, data leakage, and other malicious activities. It is crucial to upgrade to the fixed version of mongo-express to mitigate the risk of exploitation. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for mongo-express →
FAQ
Mongo-express is a web-based administrative interface for MongoDB that allows users to manage databases, collections, and documents.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
An attacker can exploit this vulnerability by sending a large amount of data in a field of a document, which can lead to various attacks such as exporting collections to an attacker-controlled server or dropping databases or collections.
No, there is no known workaround for this vulnerability. It is recommended to upgrade to the fixed version of mongo-express.
To fix this vulnerability, it is recommended to upgrade to version 1.0.0-alpha.4 of mongo-express.
References
Related vulnerabilities
Recent vulnerabilities recorded for mongo-express.
