CVE-2019-10758

critical · 9.9Actively exploited

On the CISA Known Exploited Vulnerabilities catalog

Apply updates per vendor instructions.

Added 2021-12-10Remediation due 2022-06-10

A public exploit / detection template exists

Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →

mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method. A misuse of the `vm` dependency to perform `exec` commands in a non-safe environment.

9.9

CVSS

84.7%

EPSS (exploit prob.)

100th

EPSS percentile

2019-12-24

Published

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weaknesses

CWE-94

Affected products

Vendor	Product	Affected versions
mongo-express_project	mongo-express	< 0.54.0

Check a specific version with /api/v1/cve/match.

References

https://snyk.io/vuln/SNYK-JS-MONGOEXPRESS-473215
https://snyk.io/vuln/SNYK-JS-MONGOEXPRESS-473215
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-10758

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2019-10758