CVE-2019-10758

CriticalCVSS 9.9/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method. A misuse of the `vm` dependency to perform `exec` commands in a non-safe environment.

Metrics

CVSS 3.1 9.9/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published
Dec 24, 2019
Last modified
Jun 17, 2026
Added to CISA KEV
Dec 10, 2021
NVD status
Analyzed

Related CVEs from 2019

CVE-2019-107599.9safer-eval before 1.3.4 are vulnerable to Arbitrary Code Execution. A payload using constructor properties can escape the sandbox and executCVE-2019-10765.4A Cross-site Scripting (XSS) vulnerability exists when Team Foundation Server does not properly sanitize user provided input, aka 'Team FounCVE-2019-107609.9safer-eval before 1.3.2 are vulnerable to Arbitrary Code Execution. A payload using constructor properties can escape the sandbox and executCVE-2019-107618.3This affects the package vm2 before 3.6.11. It is possible to trigger a RangeError exception from the host rather than the "sandboxed" conteCVE-2019-107629.8columnQuote in medoo before 1.7.5 allows remote attackers to perform a SQL Injection due to improper escaping.CVE-2019-107636.5pimcore/pimcore before 6.3.0 is vulnerable to SQL Injection. An attacker with limited privileges (classes permission) can achieve a SQL injeCVE-2019-107647.4In elliptic-php versions priot to 1.0.6, Timing attacks might be possible which can result in practical recovery of the long-term private keCVE-2019-107659.8iobroker.admin before 3.6.12 allows attacker to include file contents from outside the `/log/file1/` directory.CVE-2019-107669.8Pixie versions 1.0.x before 1.0.3, and 2.0.x before 2.0.2 allow SQL Injection in the limit() function due to improper sanitization.CVE-2019-107677.5An attacker can include file contents from outside the `/adapter/xxx/` directory, where `xxx` is the name of an existent adapter like "adminCVE-2019-107687.5In AngularJS before 1.7.9 the function `merge()` could be tricked into adding or modifying properties of `Object.prototype` using a `__protoCVE-2019-107699.8safer-eval is a npm package to sandbox the he evaluation of code used within the eval function. Affected versions of this package are vulner