CVE-2019-10789 OS Command Injection in curling
Attackers can execute arbitrary commands via the run function in curling.js due to lack of input sanitization.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-10789?
CVE-2019-10789 is a critical command injection vulnerability in curling.js, published on 6 Feb 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
All versions of curling.js are vulnerable to Command Injection via the run function. The command argument can be controlled by users without any sanitization.
Weakness: CWE-78
Which versions are affected by CVE-2019-10789?
2 open source packages ship an affected version, including curling. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
curling npm | All versions | 1.1.0 |
curling npm | All versions | 1.1.0 |
Products include Curling Project Curling.
How do I fix CVE-2019-10789?
Upgrade curling to 1.1.0 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2019-10789 being exploited?
There is no known exploitation of CVE-2019-10789 in the wild and no public exploit code.
Sources
Also known as GHSA-xmxh-g7wj-8m4m.