Remote Code Execution (RCE)

Overview mongo-express is a web-based MongoDB admin interface written with Node.js, Express and Bootstrap3 Affected versions of this package are vulnerable to Remote Code Execution RCE via endpoints that use the toBSON method. A misuse of the vm dependency to perform exec commands in a non-safe...