Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2019-10804: Serial-number tool may let attackers run any command
CVE-2019-10804 · published 6 years ago
Summary
The Serial-number software (versions up to 1.3.0) can run commands that it receives without checking them first. An attacker could supply specially crafted input and cause the program to execute any command on the server, potentially stealing data or disrupting services. Update to a version that validates input or apply a patch that sanitizes the cmdPrefix argument.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| npm | es128 | serial-number | <= 1.3.0 |
| – | serial-number_project | serial-number |
<= 1.3.0 cpe:2.3:a:serial-number_project:serial-number:*:*:*:*:*:node.js:*:* |
Original advisory text
OS Command Injection in serial-number
serial-number through 1.3.0 allows execution of arbritary commands. The "cmdPrefix" argument in serialNumber function is used by the "exec" function without any validation.
References
- https://nvd.nist.gov/vuln/detail/CVE-2019-10804
- https://github.com/advisories/GHSA-3fw4-4h3m-892h
- https://github.com/es128/serial-number/blob/master/index.js#L106 Third Party Advisory
- https://snyk.io/vuln/SNYK-JS-SERIALNUMBER-559010 Exploit Third Party Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Type
CWE-78OS Command Injection
Timeline
Published28 Feb 2020
Updated30 Oct 2026
First seen6 Mar 2026
Track software like this
Free during beta