CVE-2019-19609

PoC ×3—

CVSS 3.1

7.2 high

EPSS

54%p99

Published

Dec 5, 2019 (Dec 5, 2019)

Modified

Jun 17, 2026

Description

The Strapi framework before 3.0.0-beta.17.8 is vulnerable to Remote Code Execution in the Install and Uninstall Plugin components of the Admin panel, because it does not sanitize the plugin name, and attackers can inject arbitrary shell commands to be executed by the execa function.

Vendors: strapi
Products: strapi
Weakness: CWE-78
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (54.1%)

In the news0 stories

No ingested article mentions this CVE yet.