CVE-2019-10758: Remote Code Execution Vulnerability in NPM mongo-express
Summary
CVE-2019-10758: Remote Code Execution Vulnerability in NPM mongo-express. Affects mongo-express versions < 0.54.0. Fixed in 0.54.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mongo-express is an open-source web-based MongoDB admin interface. It provides a user-friendly interface for managing MongoDB databases, collections, and documents. This vulnerability affects versions prior to 0.54.0 of the mongo-express package. The vulnerability allows any authenticated user to execute arbitrary code on the host machine.
Vulnerability Detail
The vulnerability allows an attacker to execute arbitrary code on the host machine by exploiting a remote code execution vulnerability in the mongo-express package. By pasting a specific payload into the 'create index' field, an attacker can trigger the execution of arbitrary commands on the host machine. In the provided proof of concept, the payload pops open the Mac calculator. This vulnerability poses a significant risk as it allows an authenticated user to execute arbitrary commands with the privileges of the mongo-express process.
How To Fix
Latest published version: 1.1.0-rc-4 as of 23 Oct 2026
npm install mongo-express@1.1.0-rc-4Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.54.0
This is the first release that contains the fix.
npm install mongo-express@0.54.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. Users must upgrade to the patched version to mitigate the risk of remote code execution.
Conclusion
The remote code execution vulnerability in the mongo-express package allows any authenticated user to execute arbitrary code on the host machine. To mitigate this risk, users should upgrade to version 0.54.0 of the package. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mongo-express →
FAQ
Mongo-express is a web-based MongoDB admin interface that allows users to manage MongoDB databases, collections, and documents through a user-friendly interface.
The vulnerability allows any authenticated user to execute arbitrary code on the host machine, posing a significant security risk.
To fix this vulnerability, users should upgrade to version 0.54.0 of the mongo-express package.
No, there is no known workaround for this vulnerability. Users must upgrade to the patched version.
You can find more information about this vulnerability in the Snyk Security Advisory and the CVE entry provided in the references section.
References
Related vulnerabilities
Recent vulnerabilities recorded for mongo-express.
