How severe is CVE-2019-10758?

CVE-2019-10758 has a CVSS 3.1 base score of 9.9 (CRITICAL). EPSS estimates a 84.7% probability of exploitation in the next 30 days. It is listed in the CISA Known Exploited Vulnerabilities catalog.

CVE-2019-10758: MongoDB mongo-express Remote Code Execution

CISA Known Exploited Vulnerabilities

MongoDB mongo-express Remote Code Execution Vulnerability is confirmed as actively exploited and is listed in the CISA KEV catalog.

Added to KEV

2021-12-10

Remediation due

2022-06-10

Required action
Apply updates per vendor instructions.

CISA notes
https://nvd.nist.gov/vuln/detail/CVE-2019-10758

Description

mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method. A misuse of the `vm` dependency to perform `exec` commands in a non-safe environment.

Severity

CVSS 3.1 · CISA9.9 CRITICAL

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

SSVC · CISA-ADP

Exploitationactive

Automatableno

Technical impacttotal

Affected Products

Vendor	Product	Affected versions
-	mongo-express	All versions prior to version 0.54.0

References

1 Links

Other references

https://snyk.io/vuln/SNYK-JS-MONGOEXPRESS-473215

Record Details

Published

2019-12-24

Last updated

2025-10-21

Assigner (CNA)

snyk

Credited to

CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.