CVE-2019-10789

All versions of curling.js are vulnerable to Command Injection via the run function. The command argument can be controlled by users without any sanitization.

Affected

curling.js

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C

EPSS

4.87% chance of exploitation in the next 30 days, 92nd percentile

Published

2020-02-06

Updated

2024-08-04

Proof-of-concept exploits (1)

• https://snyk.io/vuln/SNYK-JS-CURLING-546484

Security advisories

• hgarcia/curling/blob/e861d625c074679a2931bcf4ce8da0afa8162c53/lib/curl-transport.js#L56
• advisories/GHSA-xmxh-g7wj-8m4m

References

• CVE Record
• NVD entry