CVE-2019-10758
100Vexday Risk Score
Patch now. It under exploitation confirmed by CISA and has a working public exploit.
ssvc Actcvss 9.9epss 85%
from disclosure to weapon2 days
Published on NVDDec 24
1st PoC+2d
CISA KEV+717d
exploitation probability
85%top 1% of all CVEs
observed exploitation
yesCISA + VulnCheck
4 public exploit(s)
Action required by CISAfederal deadline: 2022-06-10
Apply updates per vendor instructions.
Versions
Affected
npm/mongo-express < 0.54.0
Fixed in
npm/mongo-express 0.54.0
Researched and written with AI from the vendor advisory and public analysis, with the sources above. Always confirm the fixed version in the official advisory before acting.
mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method. A misuse of the `vm` dependency to perform `exec` commands in a non-safe environment.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected products
n/a · mongo-expresspublic PoCs found — 4
githubgithub.com/masahiro331/CVE-2019-10758★ 111githubgithub.com/lp008/CVE-2019-10758★ 5vulncheckvulncheck.com/xdb/b7262551c538unverifiedvulncheckvulncheck.com/xdb/463bdb6b5b20unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.