9.9
Critical
CVE-2019-10758 MongoDB mongo-express Remote Code Execution Vulnerability
Active exploitation observed
· CISA KEV catalogue
Required action
Apply updates per vendor instructions.
Ransomware campaigns
Not observed so far
Description
mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method. A misuse of the `vm` dependency to perform `exec` commands in a non-safe environment.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| mongo-express | Versions not published |