Command Injection in strapi

HIGH 7.2CVE-2019-19609 · GHSA-9p2w-rmx4-9mw7 · Published 05/12/2019 · updated 17/06/2026

Package	Affected versions	Patched versions
strapi strapi	`= 3.0.0≤ 1.6.4`	No fix yet
strapi npm	`< 3.0.0-beta.17.8`	`3.0.0-beta.17.8`

Description

Versions of strapi before 3.0.0-beta.17.8 are vulnerable to Command Injection. The package fails to sanitize plugin names in the /admin/plugins/install/ route. This may allow an authenticated attacker with admin privileges to run arbitrary commands in the server.

Recommendation

Upgrade to version 3.0.0-beta.17.8 or later

NVD description

The Strapi framework before 3.0.0-beta.17.8 is vulnerable to Remote Code Execution in the Install and Uninstall Plugin components of the Admin panel, because it does not sanitize the plugin name, and attackers can inject arbitrary shell commands to be executed by the execa function.

References

nvd.nist.gov/vuln/detail/CVE-2019-19609 · ADVISORY
strapi/strapi#4636 · WEB
bittherapy.net/post/strapi-framework-remote-code-execution · WEB
strapi/strapi · PACKAGE
npmjs.com/advisories/1424 · WEB
packetstormsecurity.com/files/163940/Strapi-3.0.0-beta.17.7-Remote-Code-Execution.html · WEB
packetstormsecurity.com/files/163950/Strapi-CMS-3.0.0-beta.17.4-Remote-Code-Execution.html · WEB
bittherapy.net/post/strapi-framework-remote-code-execution · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free