Command Injection in node-df

CRITICAL 9.8CVE-2019-15597 · GHSA-wp7m-mrvf-599c · Published 18/12/2019 · updated 17/06/2026

In short

CVE-2019-15597 is a CRITICAL (CVSS 9.8) vulnerability affecting node-df (node-df project), node-df.
Chance of exploitation in the next 30 days (EPSS): 2.7%, higher than 86.3% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
node-df node-df_project	`= 0.1.4`	No fix yet
node-df npm	`≤ 0.1.4`	No fix yet

Description

All versions of node-df are vulnerable to Command Injection. The package fails to sanitize filenames passed to the file option. If this value is user-controlled it may allow attackers to run arbitrary commands in the server.

Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

NVD description

A code injection exists in node-df v0.1.4 that can allow an attacker to remote code execution by unsanitized input.

References

nvd.nist.gov/vuln/detail/CVE-2019-15597 · ADVISORY
hackerone.com/reports/703412 · WEB
adriano-di-giovanni/node-df · PACKAGE
npmjs.com/advisories/1431 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free