CVE-2019-10758 MongoDB mongo-express Remote Code Execution

Exploited in the wild Critical 9.9 Published 24 Dec 2019 Updated 21 Oct 2025

Attackers can execute arbitrary code via the toBSON method in mongo-express due to unsafe vm usage, requiring an upgrade to secure the application.

Exploited in the wild: Since 10 Dec 2021
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2019-10758?

CVE-2019-10758 is a critical code injection vulnerability in mongo-express, published on 24 Dec 2019. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method. A misuse of the `vm` dependency to perform `exec` commands in a non-safe environment.

Weakness: CWE-94

Which versions are affected by CVE-2019-10758?

2 open source packages ship an affected version, including mongo-express. It affects 1 product.

Package	Affected	Fixed in
`mongo-express` npm	All versions	`0.54.0`
`mongo-express` npm	All versions	`0.54.0`

Products include Mongo-Express Project Mongo-Express.

How do I fix CVE-2019-10758?

Upgrade mongo-express to 0.54.0 or later. US federal agencies must fix it by 10 Jun 2022.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2019-10758 being exploited?

Yes. Attackers have exploited CVE-2019-10758 in the wild since at least 10 Dec 2021.

Public exploit code: 1 Nuclei template and 3 proofs of concept on GitHub.

Sources

Also known as GHSA-h47j-hc6x-h3qq, SNYK-JS-MONGOEXPRESS-473215.