Back to overview

CVE-2019-10758

CRITICAL KEV CISA Exploitation: ACTIVE
9.9
CVSS 3.1
Description
mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method. A misuse of the `vm` dependency to perform `exec` commands in a non-safe environment.

Metadata

CVE ID
CVE-2019-10758
State
PUBLISHED
Assigner
snyk
Reserved
2019-04-03 00:00 UTC
Published
2019-12-24 21:08 UTC
Last updated
2025-10-21 23:35 UTC
Primary CWE
CWE-94
CWE-94 Improper Control of Generation of Code ('Code Injecti…
Vendor / Product
n/a / mongo-express
Sources
cve.org  ·  NVD

Severity & Metrics

9.9 CRITICAL CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
SSVC — CISA Coordinator
Exploitation
ACTIVE
Automatable
no
Tech. Impact
total
CISA Known Exploited Vulnerability
Vulnerability name
MongoDB mongo-express Remote Code Execution Vulnerability
Vendor
MongoDB
Product
mongo-express
Added to KEV
2021-12-10
Due date
2022-06-10
Ransomware
Not known
Required action
Apply updates per vendor instructions.
CISA description
mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method.
Affected products (1)
VendorProductPlatformVersions
n/a mongo-express — All versions prior to version 0.54.0
Weakness (CWE)
CWESourceDescription
— cna Remote Code Execution
CWE-94 adp CWE-94 Improper Control of Generation of Code ('Code Injection')
CVSS scores (1)
ScoreSeverityVersionSourceVector
9.9 CRITICAL 3.1 adp CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
References (1)
Back to overview