critical9.9Known exploited
CVE-2019-10758
MongoDB mongo-express Remote Code Execution Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2021-12-10. Federal due date: 2022-06-10.
Apply updates per vendor instructions.
Impact
mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method. A misuse of the `vm` dependency to perform `exec` commands in a non-safe environment.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mongo-Express Project | Mongo-Express | before 0.54.0 |