VULNERABILITY INTELLIGENCE

CVE-2019-10758

CVSS score9.9 CRITICAL

EPSS probability84.73%

CISA KEVKnown exploited vulnerability

Published2019-12-24

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Known Exploited Vulnerability

MongoDB mongo-express Remote Code Execution Vulnerability

Vendor / product: MongoDB / mongo-express

Description

mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method. A misuse of the `vm` dependency to perform `exec` commands in a non-safe environment.

Weakness classification

CWE-94: Improper Control of Generation of Code ('Code Injection')

Primary references

report@snyk.io — Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0 — US Government Resource