CVE-2019-5413: Code Injection
An attacker can use the format parameter to inject arbitrary commands in the npm package morgan < 1.9.1.
Other sources
Verisons of morgan before 1.9.1 are vulnerable to code injection when user input is allowed into the filter or combined with a prototype pollution attack.
Recommendation
Update to version 1.9.1 or later.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/morganto a version that resolves this vulnerability.Fixed in 1.9.1
Event History
Frequently Asked Questions
What is the severity of CVE-2019-5413?
The severity of CVE-2019-5413 is critical with a score of 9.8.
How do I fix CVE-2019-5413?
To fix CVE-2019-5413, you should update the morgan package to version 1.9.1 or later.
What type of vulnerability is CVE-2019-5413?
CVE-2019-5413 is a code injection vulnerability that can result in arbitrary command execution.
Which software is affected by CVE-2019-5413?
The npm package morgan versions prior to 1.9.1 are affected by CVE-2019-5413.
Can CVE-2019-5413 lead to data exposure?
Yes, CVE-2019-5413 can lead to data exposure due to the potential for command injection.