Command Injection in gitlabhook

CRITICAL 10.0CVE-2019-5485 · GHSA-549f-73hh-mj38 · Published 13/09/2019 · updated 17/06/2026

Package	Affected versions	Patched versions
gitlabhook gitlabhook_project	`= 0.0.17`	No fix yet
gitlabhook npm	`≤ 0.0.17`	No fix yet

Description

All versions of gitlabhook are vulnerable to Command Injection. The package does not validate input the body of POST request and concatenates it to an exec call, allowing attackers to run arbitrary commands in the system.

Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

NVD description

NPM package gitlabhook version 0.0.17 is vulnerable to a Command Injection vulnerability. Arbitrary commands can be injected through the repository name.

References

nvd.nist.gov/vuln/detail/CVE-2019-5485 · ADVISORY
hackerone.com/reports/685447 · WEB
packetstormsecurity.com/files/154598/NPMJS-gitlabhook-0.0.17-Remote-Command-Execution.html · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free