Versions of express-cart before 1.1.6 are vulnerable to privilege escalation. This vulnerability can be exploited so that normal users can escalate their privilege and add new administrator users.

Recommendation

Update to version 1.1.6 or later.

References

• mrvautin/expressCart@baccaae
• https://www.npmjs.com/advisories/730
• https://hackerone.com/reports/343626
• https://github.com/nodejs/security-wg/blob/master/vuln/npm/469.json
• https://snyk.io/vuln/npm:express-cart:20180712