Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2019-10789: hgarcia/curling and curling_project/curling allow command execution
CVE-2019-10789 · published 6 years ago
Summary
Both curling.js libraries let a user‑controlled input be passed directly to the operating system, so an attacker could run any command on the server. This can lead to data theft, system compromise, or service disruption. Update to a patched version or add proper input validation before executing commands.
What to do
- Update hgarcia curling to version 1.1.0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| npm | hgarcia | curling |
<= 1.0.0 Fix: upgrade to 1.1.0
|
| – | curling_project | curling |
All versions
cpe:2.3:a:curling_project:curling:*:*:*:*:*:node.js:*:* |
Original advisory text
OS Command Injection in curling
All versions of curling.js are vulnerable to Command Injection via the run function. The command argument can be controlled by users without any sanitization.
References
- https://nvd.nist.gov/vuln/detail/CVE-2019-10789
- https://github.com/advisories/GHSA-xmxh-g7wj-8m4m
- https://github.com/hgarcia/curling/blob/e861d625c074679a2931bcf4ce8da0afa8162c53... Exploit Third Party Advisory
- https://snyk.io/vuln/SNYK-JS-CURLING-546484 Exploit Third Party Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Type
CWE-78OS Command Injection
Timeline
Published6 Feb 2020
Updated25 Oct 2026
First seen6 Mar 2026
Track software like this
Free during beta