# CVE-2020-24391: mongo-express remote code execution in query parsing

Source: https://junglewise.ai/threats/cve-2020-24391-mongo-express-remote-code-execution-in-query-parsing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2021-04-13. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2020-24391 · Severity: low · CVSS 3.1 · Published 2021-04-13

mongo-express is a web-based MongoDB administration tool used to manage databases and collections. An unsafe implementation of advanced query syntax allows attackers to execute arbitrary code on the server, potentially compromising the entire database and any systems the application can reach.

Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2020-24391 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2020-24391 being exploited in the wild.

**How severe is CVE-2020-24391?** Low severity, with a CVSS score of 3.1, published 13 April 2021.

**Which products and versions are affected?** Mongodb-Js Query-Parser before 2.0.0; mongodb-query-parser (npm) SEMVER:introduced=0,fixed=2.0.0.

**Is there a fix for CVE-2020-24391?** Yes. mongodb-query-parser (npm): upgrade to 2.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2020-24391 attacked?** It is attacked over the network.

**Am I affected by CVE-2020-24391?** Check whether you run Mongodb-Js Query-Parser or mongodb-query-parser (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- mongodb-query-parser (npm): upgrade to 2.0.0 or later

  ```sh
  npm install mongodb-query-parser@2.0.0
  ```


## Technical details

The vulnerability exists in mongo-express before version 1.0.0 and its dependency mongodb-query-parser, where advanced MongoDB query syntax is parsed without proper sanitization (CWE-20: Improper Input Validation). The root cause is unsafe handling of query expressions that allows code injection. An unauthenticated attacker can craft a malicious MongoDB query and send it to the mongo-express web interface over the network to achieve remote code execution. The vulnerability has been patched in mongodb-query-parser version 2.0.0 and mongo-express 1.0.0.

## Affected products

- mongo-express mongo-express before 1.0.0
- mongodb-js query-parser before 2.0.0

## Identifiers

- CVE-2020-24391
- GHSA-hxmg-hm46-cf62

## Timeline

- 2021-03-30: disclosed: NVD published vulnerability
- 2021-04-13: advisory: GitHub Security Advisory published

## References

- [https://github.com/mongodb-js/query-parser/issues/16](https://github.com/mongodb-js/query-parser/issues/16)

## Related threats

- [mongodb-query-parser code execution via unsanitized queries](https://junglewise.ai/threats/mongodb-query-parser-code-execution-via-unsanitized-queries-a810e6b5)