# express-cart NoSQL injection in login

Source: https://junglewise.ai/threats/express-cart-nosql-injection-in-login-f1d83a16  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2020-09-01. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

Severity: info · Published 2020-09-01

express-cart is a Node.js e-commerce shopping cart application. Attackers can bypass authentication and extract sensitive data (such as authentication tokens) by injecting NoSQL operators into the login forms, similar to SQL injection attacks on traditional databases. This allows unauthorized access to both customer and admin accounts.

Technologies: [express-cart (npm)](https://junglewise.ai/threats/technologies/express-cart). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Informational severity, published 1 September 2020.

**Which products and versions are affected?** express-cart (npm) SEMVER:introduced=0,fixed=1.1.8.

**Is there a fix for This vulnerability?** Yes. express-cart (npm): upgrade to 1.1.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run express-cart (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- express-cart (npm): upgrade to 1.1.8 or later

  ```sh
  npm install express-cart@1.1.8
  ```


## Technical details

The vulnerability is a NoSQL injection flaw (CWE-89) in the customer and admin login handlers of express-cart. User input from JSON request bodies is passed directly into MongoDB queries without sanitization, allowing attackers to insert MongoDB operators such as $regex. An attacker can exploit this via a network request to the login endpoint (no authentication required) to perform blind injection attacks, character-by-character extraction of authentication tokens or credentials. The vulnerability affects all versions before 1.1.8, which introduced input validation. A fix is available by updating to version 1.1.8 or later.

## Affected products

- express-cart express-cart before 1.1.8

## Timeline

- 2020-09-01: disclosed
- 2020-09-01: patched: Version 1.1.8 or later

## References

- [https://hackerone.com/reports/397445](https://hackerone.com/reports/397445)
- [https://github.com/nodejs/security-wg](https://github.com/nodejs/security-wg)

## Related threats

- [express-cart admin user creation auth bypass](https://junglewise.ai/threats/cve-2018-12457-express-cart-admin-user-creation-auth-bypass)
- [express-cart unrestricted file upload vulnerability](https://junglewise.ai/threats/cve-2018-3758-express-cart-unrestricted-file-upload-vulnerability)
- [express-cart Cross-Site Request Forgery in admin](https://junglewise.ai/threats/cve-2020-22403-express-cart-cross-site-request-forgery-in-admin)
- [express-cart cross-site scripting in admin](https://junglewise.ai/threats/express-cart-cross-site-scripting-in-admin-364784a1)
- [express-cart path traversal vulnerability](https://junglewise.ai/threats/express-cart-path-traversal-vulnerability-0acf6117)