CVE-2019-15701

CVE-2019-15701 is a critical vulnerability affecting BloodHound 2.2.0, specifically within its components/Modals/HelpModal.jsx file. This flaw allows remote attackers to execute arbitrary OS commands on a victim's machine by exploiting the search function's autocomplete feature. The attack requires the victim to import Active Directory data containing a Group Policy Object (GPO) with malicious JavaScript in its name. The vulnerability carries a CVSS score of 8.8 (High), indicating a severe risk. It has a network attack vector, low attack complexity, and requires user interaction, but can lead to high impacts on confidentiality, integrity, and availability. Despite its severity, there is currently no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are also minimal, suggesting a low profile.