{"id":"CVE-2019-10758","kind":"vulnerability","aliases":["CVE-2019-10758"],"related":[],"title":"MongoDB mongo-express: MongoDB mongo-express Remote Code Execution Vulnerability","description":"mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method. A misuse of the `vm` dependency to perform `exec` commands in a non-safe environment.","summary":"mongo-express versions before 0.54.0 let remote requests reach code paths that use the toBSON method, which allows remote code execution. An attacker who can reach the web interface can run commands on the server running mongo-express.","severity":"critical","cvss":9.9,"epss":0.84726,"exploited":true,"exploited_at":"2021-12-10T00:00:00+00:00","products":[{"name":"MongoDB mongo-express","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","mongo-express","mongodb","node.js","package","self-hosted"],"not_affected_if":["not-exposed-to-network","version-0.54.0-or-later"],"how_to_check":"Check the installed mongo-express version (npm ls mongo-express, or the package.json of the deployed app); anything below 0.54.0 is affected.","fix":"Upgrade mongo-express to 0.54.0 or later.\nDo not expose the mongo-express web interface to the internet; restrict it to trusted networks.","status":"open","published_at":"2019-12-24T22:15:11+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:31:50+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T21:31:50Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade mongo-express to 0.54.0 or later.\nDo not expose the mongo-express web interface to the internet; restrict it to trusted networks.","reach":"network","impact":"high","summary":"mongo-express versions before 0.54.0 let remote requests reach code paths that use the toBSON method, which allows remote code execution. An attacker who can reach the web interface can run commands on the server running mongo-express.","category":"package","who_cares":["mongo-express","mongodb","self-hosted","node.js"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Attacker runs arbitrary code on the mongo-express host server","analyst_note":"Confirm whether the vulnerable endpoints require authentication and which exact routes use toBSON; check the KEV and NVD entries for the affected version range.","how_to_check":"Check the installed mongo-express version (npm ls mongo-express, or the package.json of the deployed app); anything below 0.54.0 is affected.\nunknown\nunknown","needs_analyst":true,"not_affected_if":["version-0.54.0-or-later","not-exposed-to-network"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000498,"input_tokens":2829,"output_tokens":431,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-10758':15A,18A '-2019':14A,17A '0.54.0':38B,77C 'allow':51B 'attack':56B 'code':10A,43B,53B,82C 'command':65B,100C 'cve':13A,16A 'depend':96C 'endpoint':85C 'environ':106C 'exec':99C 'execut':11A,54B,83C 'exploit':23B 'express':4A,8A,22A,26B,35B,72B,75C 'host':32B 'interfac':62B 'let':39B 'method':49B,90C 'misus':92C 'mongo':3A,7A,21A,25B,34B,71B,74C 'mongo-express':2A,6A,20A,24B,33B,70B,73C 'mongodb':1A,5A,19A,27B 'node.js':28B 'non':104C 'non-saf':103C 'packag':29B 'path':44B 'perform':98C 'reach':42B,59B 'remot':9A,40B,52B,81C 'request':41B 'run':64B,69B 'safe':105C 'self':31B 'self-host':30B 'server':68B 'tobson':48B,89C 'use':46B,87C 'version':36B 'via':84C 'vm':95C 'vulner':12A,79C 'web':61B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2019-12-24T22:15:11+00:00","kev":{"dateAdded":"2021-12-10","dueDate":"2022-06-10","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2019-10758","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-10758","severity":null,"published_at":"2021-12-10T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T16:39:49+00:00","note":null},{"source":"epss","external_id":"CVE-2019-10758","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-10758","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2019-10758","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-10758","severity":null,"published_at":"2019-12-24T22:15:11+00:00","modified_at":"2026-06-17T02:11:36+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}