CVE-2019-19609

The Strapi framework before 3.0.0-beta.17.8 is vulnerable to Remote Code Execution in the Install and Uninstall Plugin components of the Admin panel, because…

published December 5, 2019

Patch now

High probability of exploitation

NVD has not assigned a CVSS score to this record. It sits in the 99.0th percentile for exploit probability.

CVSS
—
EPSS
54%
Percentile
99.0
In the wild
Unconfirmed
What it is

The Strapi framework before 3.0.0-beta.17.8 is vulnerable to Remote Code Execution in the Install and Uninstall Plugin components of the Admin panel, because it does not sanitize the plugin name, and attackers can inject arbitrary shell commands to be executed by the execa function.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.54081 · 99.0th percentile
Published
2019-12-05T19:44Z
EPSS history
Timeline
  • 05 DEC 19:44Z
    The Strapi framework before 3.0.0-beta.17.8 is vulnerable to Remote Code Execution in the Install and Uninstall Plugin components of the Admin panel, because…
    cvelistv5