# express-cart cross-site scripting in admin

Source: https://junglewise.ai/threats/express-cart-cross-site-scripting-in-admin-364784a1  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2020-09-02. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

Severity: info · Published 2020-09-02

express-cart is a popular Node.js e-commerce shopping cart application. An attacker with access to the admin page can inject malicious JavaScript code through product option fields, allowing arbitrary code execution within the admin interface. This vulnerability is limited to administrative users and does not affect customer-facing pages.

Technologies: [express-cart (npm)](https://junglewise.ai/threats/technologies/express-cart). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Informational severity, published 2 September 2020.

**Which products and versions are affected?** express-cart (npm) SEMVER:introduced=0.

**Is there a fix for This vulnerability?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run express-cart (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a stored Cross-Site Scripting (XSS) vulnerability (CWE-79) in the admin product management interface of express-cart. The vulnerability exists because user input for product options is not properly sanitized or escaped before being rendered in the admin page. An attacker who can access the admin interface can inject arbitrary JavaScript that will execute in the browser of any admin user viewing the products. While the attack surface is limited to authenticated admin users, successful exploitation could lead to account compromise, data exfiltration, or unauthorized administrative actions. No patch has been released; users should consider alternative e-commerce solutions.

## Affected products

- express-cart express-cart all versions

## Timeline

- 2020-09-02: disclosed
- 2020-09-02: advisory

## References

- [https://hackerone.com/reports/395944](https://hackerone.com/reports/395944)
- [https://www.npmjs.com/advisories/808](https://www.npmjs.com/advisories/808)

## Related threats

- [express-cart admin user creation auth bypass](https://junglewise.ai/threats/cve-2018-12457-express-cart-admin-user-creation-auth-bypass)
- [express-cart unrestricted file upload vulnerability](https://junglewise.ai/threats/cve-2018-3758-express-cart-unrestricted-file-upload-vulnerability)
- [express-cart Cross-Site Request Forgery in admin](https://junglewise.ai/threats/cve-2020-22403-express-cart-cross-site-request-forgery-in-admin)
- [express-cart NoSQL injection in login](https://junglewise.ai/threats/express-cart-nosql-injection-in-login-f1d83a16)
- [express-cart path traversal vulnerability](https://junglewise.ai/threats/express-cart-path-traversal-vulnerability-0acf6117)