CVE-2019-5413
CVE-2019-5413
This page contains facts from public vulnerability sources. Check the original advisory before updating.
An attacker can use the format parameter to inject arbitrary commands in the npm package morgan < 1.9.1.
CVSS 9.8 · Critical · EPSS 3.4% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
Original sources
- https://hackerone.com/reports/390881
- https://lists.apache.org/thread.html/r8ba4c628fba7181af58817d452119481adce4ba92e889c643e4c7dd3%40%3Ccommits.netbeans.apache.org%3E
- https://lists.apache.org/thread.html/rb5ac16fad337d1f3bb7079549f97d8166d0ef3082629417c39f12d63%40%3Cnotifications.netbeans.apache.org%3E
- https://nvd.nist.gov/vuln/detail/CVE-2019-5413