# CVE-2021-21422: mongo-express multiple cross-site scripting vulnerabilities

Source: https://junglewise.ai/threats/cve-2021-21422-mongo-express-multiple-cross-site-scripting-vulnerabilities  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2021-06-28. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2021-21422 · Severity: low · CVSS 3.1 · Published 2021-06-28

mongo-express is a web-based MongoDB administration tool. Two cross-site scripting (XSS) vulnerabilities allow unauthorized users to inject malicious code that executes in admin browsers, potentially enabling theft of sensitive database exports, unauthorized database operations, or session hijacking without the administrator's knowledge.

Technologies: [mongo-express (npm)](https://junglewise.ai/threats/technologies/npm-mongo-express). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2021-21422 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2021-21422 being exploited in the wild.

**How severe is CVE-2021-21422?** Low severity, with a CVSS score of 3.1, published 28 June 2021.

**Which products and versions are affected?** mongo-express (npm) SEMVER:introduced=0,fixed=1.0.0-alpha.4.

**Is there a fix for CVE-2021-21422?** Yes. mongo-express (npm): upgrade to 1.0.0-alpha.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2021-21422 attacked?** It is attacked over the network.

**Am I affected by CVE-2021-21422?** Check whether you run mongo-express (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- mongo-express (npm): upgrade to 1.0.0-alpha.4 or later

  ```sh
  npm install mongo-express@1.0.0-alpha.4
  ```


## Technical details

Two distinct XSS vulnerabilities exist in mongo-express. The first occurs when document content exceeds display limits: clicking a truncated row displays the full unescaped document to an admin user, allowing injected JavaScript execution. The second vulnerability is in media cell rendering (image, audio, video), where data cells identified as media are rendered without sanitization, permitting script injection. Both attack vectors require admin user interaction. Successful exploitation enables attackers to execute arbitrary JavaScript in the admin's browser context, potentially exfiltrating database exports, dropping databases, or performing unauthorized administrative actions. The vulnerabilities affect all versions prior to v1.0.0-alpha.4, which includes the patch.

## Affected products

- mongo-express mongo-express < v1.0.0-alpha.4

## Identifiers

- CVE-2021-21422
- GHSA-7p8h-86p5-wv3p

## Timeline

- 2021-06-28: disclosed
- 2021-06-28: patched: v1.0.0-alpha.4

## References

- [https://github.com/mongo-express/mongo-express/security/advisories/GHSA-7p8h-86p5-wv3p](https://github.com/mongo-express/mongo-express/security/advisories/GHSA-7p8h-86p5-wv3p)

## Related threats

- [mongo-express Cross-Site Request Forgery in admin interface](https://junglewise.ai/threats/cve-2023-52555-mongo-express-cross-site-request-forgery-in-admin-interface)
- [mongo-express denial of service in CSV export](https://junglewise.ai/threats/cve-2021-23372-mongo-express-denial-of-service-in-csv-export)
- [mongo-express remote code execution in index creation](https://junglewise.ai/threats/cve-2019-10758-mongodb-mongo-express-remote-code-execution-vulnerability)