critical9.8
CVE-2019-10789
All versions of curling.js are vulnerable to Command Injection via the run function.
Impact
All versions of curling.js are vulnerable to Command Injection via the run function. The command argument can be controlled by users without any sanitization.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Curling Project | Curling | All versions |
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/hgarcia/curling/blob/e861d625c074679a2931bcf4ce8da0afa8162c53/lib/curl-transport.js#L56
- https://snyk.io/vuln/SNYK-JS-CURLING-546484
- https://github.com/hgarcia/curling/blob/e861d625c074679a2931bcf4ce8da0afa8162c53/lib/curl-transport.js#L56
- https://snyk.io/vuln/SNYK-JS-CURLING-546484