MongoDB · mongo-express
CVE-2019-10758
MongoDB mongo-express Remote Code Execution Vulnerability
Exploited in attacks
Critical 9.9 Attack chance: 85%
What it is
mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method. A misuse of the `vm` dependency to perform `exec` commands in a non-safe environment.
CISA: mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: June 10, 2022
- Added to the CISA list
- December 10, 2021
- Published
- December 24, 2019
- Severity
- Critical 9.9 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 85% in the top 0.3% of all known vulnerabilities
- More details
- NVD · CVE.org · CISA
All references (1)
More exploited flaws from MongoDB
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Dec 29, 2025 | and MongoDB Server Improper Handling of Length Parameter Inconsistency | MongoDB and MongoDB Server | High 8.7 | 83% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.