← Vulnerability feed

Vulnerability record · CVE-2021-21422 · published 21 June 2021

CVE-2021-21422: Mongo-express project mongo-express cross-site scripting vulnerability

MMongo Express Project · Mongo Express

mongo-express is a web-based MongoDB admin interface, written with Node.js and express. 1: As mentioned in this issue: https://github.com/mongo-express/mongo-express/issues/577, when the content of a cell grows larger than supported size, clicking on a row will show full document unescaped, however this needs admin interaction on cell. 2: Data cells identified as media will be rendered as media, without being sanitized. Example of different renders: image, audio, video, etc. As an example of type 1 attack, an unauthorized user who only can send a large amount of data in a field of a document may use a payload with embedded javascript. This could send an export of a collection to the attacker without even an admin knowing. Other types of attacks such as dropping a database\collection are possible.

6.1 CVSS 3.1 Medium EPSS 1.6% · top 25.6% CWE-79 · Cross-site scripting
6.1CVSS 3.1 base score, v2 4.3
1.6%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References, 4 tagged exploit
17 Jun 2026Last modified by NVD

Description

mongo-express is a web-based MongoDB admin interface, written with Node.js and express. 1: As mentioned in this issue: https://github.com/mongo-express/mongo-express/issues/577, when the content of a cell grows larger than supported size, clicking on a row will show full document unescaped, however this needs admin interaction on cell. 2: Data cells identified as media will be rendered as media, without being sanitized. Example of different renders: image, audio, video, etc. As an example of type 1 attack, an unauthorized user who only can send a large amount of data in a field of a document may use a payload with embedded javascript. This could send an export of a collection to the attacker without even an admin knowing. Other types of attacks such as dropping a database\collection are possible.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/mongo-express/mongo-express/commit/f5e0d4931f856f032f22664b5e5901d5950cfd4b PatchThird Party Advisory
https://github.com/mongo-express/mongo-express/issues/577 ExploitThird Party Advisory
https://github.com/mongo-express/mongo-express/security/advisories/GHSA-7p8h-86p5-wv3p ExploitThird Party Advisory
https://github.com/mongo-express/mongo-express/commit/f5e0d4931f856f032f22664b5e5901d5950cfd4b PatchThird Party Advisory
https://github.com/mongo-express/mongo-express/issues/577 ExploitThird Party Advisory
https://github.com/mongo-express/mongo-express/security/advisories/GHSA-7p8h-86p5-wv3p ExploitThird Party Advisory

Track CVE-2021-21422 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.9CVE-2019-10758mongo-express toBSON endpoint code injection enables RCEmongo-express before 0.54.0 misuses the vm dependency to run exec commands in a non-safe environment, allowing code injection through endpoints that …KEVEPSS 85%analysed9.8CVE-2020-24391mongo-express unsafe advanced syntax handling enables code executionmongo-express before 1.0.0 supports certain advanced syntax but implements it unsafely, allowing crafted input to be evaluated rather than treated as…EPSS 75%analysed7.5CVE-2021-23372Mongo-express project mongo-express vulnerabilityAll versions of package mongo-express are vulnerable to Denial of Service (DoS) when exporting an empty collection as CSV, due to an unhandled except…EPSS 0.88%6.1CVE-2023-52555Mongo-express project mongo-express cross-site request forgery vulnerabilityIn mongo-express 1.0.2, /admin allows CSRF, as demonstrated by deletion of a Collection.EPSS 0.21%6.1CVE-2026-42897Microsoft Exchange Server XSS enables spoofingMicrosoft Exchange Server and Exchange Server Subscription Edition fail to neutralize input during web page generation, a cross-site scripting flaw (…KEVEPSS 0.52%analysed6.1CVE-2025-48700Zimbra Classic UI stored XSS via crafted email HTMLZimbra Collaboration Suite Classic UI fails to properly sanitize HTML content in email messages, allowing crafted tag structures and attribute values…KEVEPSS 1.7%analysed6.1CVE-2025-66376Zimbra Collaboration Classic UI stored XSS via CSS @import in emailZimbra Collaboration Suite 10 before 10.0.18 and 10.1 before 10.1.13 allows stored cross-site scripting in the Classic UI through CSS @import directi…KEVEPSS 20%analysed6.1CVE-2025-68461Roundcube Webmail XSS via SVG animate tagRoundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is vulnerable to cross-site scripting through the animate tag in an SVG document. Because the f…KEVEPSS 27%analysed

Source: NIST National Vulnerability Database (record CVE-2021-21422), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.