CVE-2019-10758: mongo-express toBSON endpoint code injection enables RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 9.9, CISA KEV listing, and very high EPSS probability indicate active exploitation risk with severe impact.

What it is

mongo-express before 0.54.0 misuses the vm dependency to run exec commands in a non-safe environment, allowing code injection through endpoints that call the toBSON method. Because mongo-express is a web admin interface for MongoDB, a successful attack can compromise the database management layer itself.

Impact

An attacker can execute arbitrary code on the host running mongo-express, gaining control of the application and potentially the MongoDB instance it manages. The CVSS scope change (S:C) indicates impact can extend beyond the vulnerable component.

Attack surface

Reached over the network via HTTP requests to mongo-express endpoints that invoke toBSON; the CVSS vector requires low privileges (PR:L) and no user interaction (UI:N).

Exploitation

CISA added this to the Known Exploited Vulnerabilities catalog on 2021-12-10, and EPSS shows a 30-day probability of 0.847 (99.7th percentile); reference tags include Exploit, indicating public exploit material exists.

What to do

• Upgrade mongo-express to 0.54.0 or later, per vendor instructions.
• Restrict network access to the mongo-express admin interface to trusted management networks only.
• Do not expose mongo-express directly to the internet; place it behind authentication and a reverse proxy.
• Run mongo-express with least-privilege OS and MongoDB credentials to limit post-exploitation impact.
• Monitor for and remove any unauthorized mongo-express deployments in your environment.

Detection

• Inspect mongo-express HTTP request logs for requests to endpoints that invoke toBSON, especially with unusual or encoded payloads.
• Monitor process creation on hosts running mongo-express for unexpected child processes such as shells or interpreters spawned by Node.js.
• Alert on outbound network connections from mongo-express hosts to unfamiliar destinations, which may indicate post-exploitation activity.
• Check for unexpected changes to mongo-express configuration or files that could indicate tampering.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.