CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Showing 1โ1 of 1 advisories (Page 1/1)
2019-12-24
mongo-express Remote Code Execution (RCE) Vulnerability Analysis via vm Module Misuse (CVE-2019-10758)
[Affected Scope] All Node.js database management environments running mongo-express versions prior to 0.54.0
[Impact] Authenticated attackers can bypass the sandbox and execute arbitrary system commands on the host OS via endpoints utilizing the toBSON method
[Mitigation] Immediately upgrade the mongo-express package to version 0.54.0 or higher, restrict external access, and enforce strong authentication