cve/2019/CVE-2019-5413.md

CVE-2019-5413

Description

An attacker can use the format parameter to inject arbitrary commands in the npm package morgan < 1.9.1.

POC

Reference

• https://hackerone.com/reports/390881
• https://hackerone.com/reports/390881

Github

• https://github.com/ARPSyndicate/cvemon
• https://github.com/HotDB-Community/HotDB-Engine
• https://github.com/developer3000S/PoC-in-GitHub
• https://github.com/forse01/CVE-2019-5413-NetBeans
• https://github.com/forse01/CVE-2019-5413-NetBeans-NoJson
• https://github.com/nomi-sec/PoC-in-GitHub
• https://github.com/ossf-cve-benchmark/CVE-2019-5413