CVE-2019-10758
KEVCRITICAL 9.9EPSS 84.7%
mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method. A misuse of the `vm` dependency to perform `exec` commands in a non-safe environment.
- Affected
- mongo-express
- CVSS v3.1 NVD
- 9.9 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - CVSS v3.1 GitHub
- 9.9 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:H - CVSS v2.0 NVD
- 9.0 HIGH
AV:N/AC:L/Au:S/C:C/I:C/A:C - EPSS
- 84.73% chance of exploitation in the next 30 days, 100th percentile
- CISA KEV
- added 2021-12-10
- Nuclei
- critical
- Published
- 2019-12-24
- Updated
- 2025-10-21
Proof-of-concept exploits (5)
- https://snyk.io/vuln/SNYK-JS-MONGOEXPRESS-473215
- advisories/GHSA-h47j-hc6x-h3qq
- lp008/CVE-2019-107585★ · 2020-01-05
- masahiro331/CVE-2019-10758112★ · 2019-12-26
- ossf-cve-benchmark/CVE-2019-107581★ · 2020-12-01
Nuclei templates (1)
Vulhub environments (1)
Exploit collections (3)
- mongo-express-cve-2019-10758.ymlchaitin/xray
- CVE-2019-10758--Mongo expres rcehelloexp/0day
- CVE-2019-10758.yamlzan8in/afrog