What is GHSA-hr89-w7p6-pjmq?

GHSA-hr89-w7p6-pjmq is a security advisory published by GitHub Security Advisories with High severity. express-cart allows any user to create an admin user

Which CVE IDs does GHSA-hr89-w7p6-pjmq cover?

GHSA-hr89-w7p6-pjmq covers the following CVE IDs: CVE-2018-12457. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-hr89-w7p6-pjmq?

GHSA-hr89-w7p6-pjmq has a CVSS v3 base score of 8.8, published by GitHub Security Advisories.

Which products are affected by GHSA-hr89-w7p6-pjmq?

GHSA-hr89-w7p6-pjmq affects 1 product, including: npm/express-cart:\u003c 1.1.6.

GHSA-hr89-w7p6-pjmqHighCVSS 8.8

express-cart allows any user to create an admin user

Vendor

GitHub Security Advisories

Published

May 13, 2022

Last Modified

February 3, 2026

🔗 CVE IDs covered (1)

CVE-2018-12457 →

📋 Description

Express-Cart before 1.1.6 allows remote attackers to create an admin user via an /admin/setup Referer header.

🎯 Affected products1

npm/express-cart:< 1.1.6

🔗 References (8)

https://nvd.nist.gov/vuln/detail/CVE-2018-12457
https://github.com/mrvautin/expressCart/commit/baccaae9b0b72f00b10c5453ca00231340ad3e3b
https://hackerone.com/reports/343626
https://www.npmjs.com/package/express-cart?activeTab=versions
https://github.com/nodejs/security-wg/blob/main/vuln/npm/469.json
https://snyk.io/vuln/npm:express-cart:20180712
https://www.npmjs.com/advisories/730
https://github.com/advisories/GHSA-hr89-w7p6-pjmq