CVE-2019-10758
KEVCRITICAL 9.9EPSS 84.8%
mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method. A misuse of the `vm` dependency to perform `exec` commands in a non-safe environment.
- CVSS v3.1
- 9.9 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - CVSS v3.1
- 9.9 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - CVSS v3.1
- 9.9 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:H - CVSS v2.0
- 9.0 HIGH
AV:N/AC:L/Au:S/C:C/I:C/A:C - EPSS
- 84.84% chance of exploitation in the next 30 days, 100th percentile
- CISA KEV
- added 2021-12-10
- Nuclei
- critical
- Published
- 2019-12-24
- Updated
- 2025-10-21
Proof-of-concept exploits (5)
- https://snyk.io/vuln/SNYK-JS-MONGOEXPRESS-473215
- advisories/GHSA-h47j-hc6x-h3qq
- lp008/CVE-2019-107585★ · 2020-01-05
- masahiro331/CVE-2019-10758112★ · 2019-12-26
- ossf-cve-benchmark/CVE-2019-107581★ · 2020-12-01
Nuclei templates (1)
Vulhub environments (1)
Exploit collections (3)
- chaitin/xray/blob/master/pocs/mongo-express-cve-2019-10758.yml
- helloexp/0day/tree/master/00-CVE_EXP/CVE-2019-10758--Mongo%20expres%20rce
- zan8in/afrog/blob/main/pocs/afrog-pocs/CVE/2019/CVE-2019-10758.yaml