---
id: "CVE-2019-10758"
kind: "vulnerability"
aliases: ["CVE-2019-10758"]
title: "MongoDB mongo-express: MongoDB mongo-express Remote Code Execution Vulnerability"
severity: "critical"
cvss: 9.9
epss: 0.84726
exploited: true
status: "open"
category: "package"
products: [{"name": "MongoDB mongo-express", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "mongo-express", "mongodb", "node.js", "package", "self-hosted"]
not_affected_if: ["not-exposed-to-network", "version-0.54.0-or-later"]
published_at: "2019-12-24T22:15:11+00:00"
first_seen_at: "2026-10-23T19:11:53+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-10758", "first_seen_at": "2026-10-23T19:11:53+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2019-10758", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10758", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# MongoDB mongo-express: MongoDB mongo-express Remote Code Execution Vulnerability

mongo-express versions before 0.54.0 let remote requests reach code paths that use the toBSON method, which allows remote code execution. An attacker who can reach the web interface can run commands on the server running mongo-express.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:MongoDB mongo-express affected ? fixed ?

## How to check

Check the installed mongo-express version (npm ls mongo-express, or the package.json of the deployed app); anything below 0.54.0 is affected.

## Fix

Upgrade mongo-express to 0.54.0 or later.
Do not expose the mongo-express web interface to the internet; restrict it to trusted networks.

## Timeline

- 2026-10-23T19:11:53+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-10758
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2019-10758
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2019-10758

## From the sources

mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method. A misuse of the `vm` dependency to perform `exec` commands in a non-safe environment.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_