{"action":"Upgrade mongodb-query-parser to 2.0.0 or later.","affected":[{"fixed":"2.0.0","introduced":"0"}],"component":"mongodb-query-parser","cve_ids":["CVE-2020-24391"],"ecosystem":"npm","epss":0.74519,"exploited":false,"fixed_versions":["2.0.0"],"ghsa_id":"GHSA-hxmg-hm46-cf62","id":"tcs_01M5KFWG0E6YWXXX7YG69B75YC","modified_at":"2023-11-08T04:03:07.083823Z","published_at":"2021-04-13T15:41:01Z","references":["https://osv.dev/vulnerability/GHSA-hxmg-hm46-cf62","https://nvd.nist.gov/vuln/detail/CVE-2020-24391","https://github.com/mongodb-js/query-parser/issues/16","https://github.com/mongo-express/mongo-express/commit/3a26b079e7821e0e209c3ee0cc2ae15ad467b91a"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-hxmg-hm46-cf62","url":"https://osv.dev/vulnerability/GHSA-hxmg-hm46-cf62"}],"summary":"Remote code execution in mongo-express"}