CVE-2019-10758

mongo-express, the web-based administration interface for MongoDB, is vulnerable to remote code execution (CWE-94 code injection) in versions before 0.54.0. The flaw stems from a misuse of the Node.js `vm` dependency: endpoints that invoke the `toBSON` method evaluate attacker-supplied input via `exec`-style commands outside a properly sandboxed environment, so an authenticated web-UI user (CVSS PR:L) can trigger the flaw over the network with no user interaction. Successful exploitation yields arbitrary command execution on the host running mongo-express, typically with access to the MongoDB instance and potentially the surrounding container or server. Any mongo-express deployment prior to 0.54.0 is affected, particularly instances exposed to the internet or shared networks where default or weak credentials are in use. Exploitation is confirmed in the wild: CISA added the flaw to the Known Exploited Vulnerabilities Catalog on 2021-12-10, EPSS assigns an ~84.7% probability of exploitation within 30 days, and public proof-of-concept references are available.

What to do: Upgrade mongo-express to version 0.54.0 or later, per CISA's required action to apply vendor updates. Restrict the mongo-express web UI to trusted networks and set strong, non-default credentials, since triggering the flaw requires an authenticated session. Inventory Node.js and Docker-based deployments running mongo-express, especially internet-facing ones, and patch them promptly as this flaw is on CISA's Known Exploited Vulnerabilities list.