CRITICAL Published March 21, 2019

CVE-2019-5413

An attacker can use the format parameter to inject arbitrary commands in the npm package morgan < 1.9.1.

CVSS base score
9.8 (v3.0)
Severity
CRITICAL
Attack vector
Network
Weakness
CWE-94, CWE-77
Last modified
November 2, 2026
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

morgan project morgan

References

View full NVD advisory →

Related reading

← Back to CVE watch