Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2019-5413

31
FAUCET Score

CVE-2019-5413 is a critical command injection vulnerability affecting the npm package 'morgan' versions prior to 1.9.1. An unauthenticated attacker can exploit this by manipulating the 'format' parameter to execute arbitrary commands on the affected system. With a CVSS score of 9.8, this vulnerability poses a severe risk, allowing for complete compromise of confidentiality, integrity, and availability. Despite its high severity, there is no evidence of active exploitation, publicly available exploit code, or significant community discussion surrounding this CVE.

Impacted Technologies

VendorProductVersion(s)CPE
< 1.9.1CPE matchmatch criteria
cpe:2.3:a:morgan_project:morgan:*:*:*:*:*:node.js:*:*

CVSS Data

CVSS version used by this source: 3.0

9.8CRITICAL

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Exploitability Score
3.9
Impact Score
5.9
CvssVersion
3.0

Exploit Intelligence

EPSS Score
3.40%
Probability of exploitation in next 30 days
EPSS Percentile
87.6%
Percentile rank of EPSS score among Peer Group
As of 2026-07-25
Model: v2026.06.15
This CVE's current EPSS score of 0.0340 is in the 80th percentile among its peer group of 36,833 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (7)

npmpatch availablevia ghsa
Product: morganFixed in: 1.9.1
redhatno patchvia redhat_api
Product: Red Hat OpenShift Container Platform 3.10Fixed in: nodejs-morgan
redhatno patchvia redhat_api
Product: Red Hat OpenShift Container Platform 3.9Fixed in: nodejs-morgan
redhatend of lifevia redhat_api
Product: Red Hat OpenShift Container Platform 3.7Fixed in: nodejs-morgan
redhatend of lifevia redhat_api
Product: Red Hat OpenShift Container Platform 3.5Fixed in: nodejs-morgan
redhatend of lifevia redhat_api
Product: Red Hat OpenShift Container Platform 3.4Fixed in: nodejs-morgan
redhatend of lifevia redhat_api
Product: Red Hat OpenShift Container Platform 3.6Fixed in: nodejs-morgan

Vendor Advisories (2)

npmGHSA-gwg9-rgvj-4h5jcritical

Code Injection in morgan

Mar 25, 2019
redhatCVE-2019-5413Low

nodejs-morgan: Unescaped input in compile() function

Oct 28, 2018

References

hackerone.com / reports/390881
ExploitThird Party Advisory
lists.apache.org / thread.html/r8ba4c628fba7181af58817d452119481adce4ba92e889c643e4c7dd3%40%3Ccommits.netbeans.apache.org%3E
lists.apache.org / thread.html/rb5ac16fad337d1f3bb7079549f97d8166d0ef3082629417c39f12d63%40%3Cnotifications.netbeans.apache.org%3E