CVSS 3.1
9.9 criticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HCVE-2019-10758
Critical (9.9) in MongoDB mongo-express. In CISA KEV since 2021-12-10. EPSS 85% chance of exploitation in the next 30 days. Fixed in mongo-express 0.54.0.
mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method. A misuse of the `vm` dependency to perform `exec` commands in a non-safe environment.
Severity
- EPSS
- 85% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
- CISA KEV
- listed 2021-12-10, due 2022-06-10
- CWE
- CWE-94
- Published
- Modified
- Record from
- the NVD, synced
Affected
- mongo-express_project:mongo-express
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-h47j-hc6x-h3qq | npm | mongo-express | <0.54.0 | 0.54.0 |