{"id":"CVE-2019-19609","details":"The Strapi framework before 3.0.0-beta.17.8 is vulnerable to Remote Code Execution in the Install and Uninstall Plugin components of the Admin panel, because it does not sanitize the plugin name, and attackers can inject arbitrary shell commands to be executed by the execa function.","aliases":["GHSA-9p2w-rmx4-9mw7"],"modified":"2026-07-08T05:56:04.397183335Z","published":"2019-12-05T20:15:10.200Z","database_specific":{"unresolved_ranges":[{"extracted_events":[{"introduced":"3.0.0-alpha10\\.1"},{"last_affected":"3.0.0-alpha10\\.1"},{"introduced":"3.0.0-alpha10\\.2"},{"last_affected":"3.0.0-alpha10\\.2"},{"introduced":"3.0.0-alpha10\\.3"},{"last_affected":"3.0.0-alpha10\\.3"},{"introduced":"3.0.0-alpha11"},{"last_affected":"3.0.0-alpha11"},{"introduced":"3.0.0-alpha11\\.1"},{"last_affected":"3.0.0-alpha11\\.1"},{"introduced":"3.0.0-alpha11\\.2"},{"last_affected":"3.0.0-alpha11\\.2"},{"introduced":"3.0.0-alpha11\\.3"},{"last_affected":"3.0.0-alpha11\\.3"},{"introduced":"3.0.0-alpha12"},{"last_affected":"3.0.0-alpha12"},{"introduced":"3.0.0-alpha12\\.1"},{"last_affected":"3.0.0-alpha12\\.1"},{"introduced":"3.0.0-alpha12\\.1\\.3"},{"last_affected":"3.0.0-alpha12\\.1\\.3"},{"introduced":"3.0.0-alpha12\\.2"},{"last_affected":"3.0.0-alpha12\\.2"},{"introduced":"3.0.0-alpha12\\.3"},{"last_affected":"3.0.0-alpha12\\.3"},{"introduced":"3.0.0-alpha12\\.4"},{"last_affected":"3.0.0-alpha12\\.4"},{"introduced":"3.0.0-alpha12\\.5"},{"last_affected":"3.0.0-alpha12\\.5"},{"introduced":"3.0.0-alpha12\\.6"},{"last_affected":"3.0.0-alpha12\\.6"},{"introduced":"3.0.0-alpha12\\.7"},{"last_affected":"3.0.0-alpha12\\.7"},{"introduced":"3.0.0-alpha12\\.7\\.1"},{"last_affected":"3.0.0-alpha12\\.7\\.1"},{"introduced":"3.0.0-alpha13"},{"last_affected":"3.0.0-alpha13"},{"introduced":"3.0.0-alpha13\\.0\\.1"},{"last_affected":"3.0.0-alpha13\\.0\\.1"},{"introduced":"3.0.0-alpha13\\.1"},{"last_affected":"3.0.0-alpha13\\.1"},{"introduced":"3.0.0-alpha14"},{"last_affected":"3.0.0-alpha14"},{"introduced":"3.0.0-alpha14\\.1"},{"last_affected":"3.0.0-alpha14\\.1"},{"introduced":"3.0.0-alpha14\\.1\\.1"},{"last_affected":"3.0.0-alpha14\\.1\\.1"},{"introduced":"3.0.0-alpha14\\.2"},{"last_affected":"3.0.0-alpha14\\.2"},{"introduced":"3.0.0-alpha14\\.3"},{"last_affected":"3.0.0-alpha14\\.3"},{"introduced":"3.0.0-alpha14\\.4\\.0"},{"last_affected":"3.0.0-alpha14\\.4\\.0"},{"introduced":"3.0.0-alpha14\\.5"},{"last_affected":"3.0.0-alpha14\\.5"},{"introduced":"3.0.0-alpha15"},{"last_affected":"3.0.0-alpha15"},{"introduced":"3.0.0-alpha16"},{"last_affected":"3.0.0-alpha16"},{"introduced":"3.0.0-alpha17"},{"last_affected":"3.0.0-alpha17"},{"introduced":"3.0.0-alpha18"},{"last_affected":"3.0.0-alpha18"},{"introduced":"3.0.0-alpha19"},{"last_affected":"3.0.0-alpha19"},{"introduced":"3.0.0-alpha20"},{"last_affected":"3.0.0-alpha20"},{"introduced":"3.0.0-alpha21"},{"last_affected":"3.0.0-alpha21"},{"introduced":"3.0.0-alpha22"},{"last_affected":"3.0.0-alpha22"},{"introduced":"3.0.0-alpha23"},{"last_affected":"3.0.0-alpha23"},{"introduced":"3.0.0-alpha23\\.1"},{"last_affected":"3.0.0-alpha23\\.1"},{"introduced":"3.0.0-alpha24"},{"last_affected":"3.0.0-alpha24"},{"introduced":"3.0.0-alpha24\\.1"},{"last_affected":"3.0.0-alpha24\\.1"},{"introduced":"3.0.0-alpha25"},{"last_affected":"3.0.0-alpha25"},{"introduced":"3.0.0-alpha25\\.1"},{"last_affected":"3.0.0-alpha25\\.1"},{"introduced":"3.0.0-alpha25\\.2"},{"last_affected":"3.0.0-alpha25\\.2"},{"introduced":"3.0.0-alpha26"},{"last_affected":"3.0.0-alpha26"},{"introduced":"3.0.0-alpha26\\.1"},{"last_affected":"3.0.0-alpha26\\.1"},{"introduced":"3.0.0-alpha26\\.2"},{"last_affected":"3.0.0-alpha26\\.2"},{"introduced":"3.0.0-alpha4"},{"last_affected":"3.0.0-alpha4"},{"introduced":"3.0.0-alpha4\\.8"},{"last_affected":"3.0.0-alpha4\\.8"},{"introduced":"3.0.0-alpha5\\.3"},{"last_affected":"3.0.0-alpha5\\.3"},{"introduced":"3.0.0-alpha5\\.5"},{"last_affected":"3.0.0-alpha5\\.5"},{"introduced":"3.0.0-alpha6\\.3"},{"last_affected":"3.0.0-alpha6\\.3"},{"introduced":"3.0.0-alpha6\\.4"},{"last_affected":"3.0.0-alpha6\\.4"},{"introduced":"3.0.0-alpha6\\.7"},{"last_affected":"3.0.0-alpha6\\.7"},{"introduced":"3.0.0-alpha7\\.2"},{"last_affected":"3.0.0-alpha7\\.2"},{"introduced":"3.0.0-alpha7\\.3"},{"last_affected":"3.0.0-alpha7\\.3"},{"introduced":"3.0.0-alpha8"},{"last_affected":"3.0.0-alpha8"},{"introduced":"3.0.0-alpha8\\.3"},{"last_affected":"3.0.0-alpha8\\.3"},{"introduced":"3.0.0-alpha9"},{"last_affected":"3.0.0-alpha9"},{"introduced":"3.0.0-alpha9\\.1"},{"last_affected":"3.0.0-alpha9\\.1"},{"introduced":"3.0.0-alpha9\\.2"},{"last_affected":"3.0.0-alpha9\\.2"},{"introduced":"3.0.0-beta0"},{"last_affected":"3.0.0-beta0"},{"introduced":"3.0.0-beta1"},{"last_affected":"3.0.0-beta1"},{"introduced":"3.0.0-beta10"},{"last_affected":"3.0.0-beta10"},{"introduced":"3.0.0-beta11"},{"last_affected":"3.0.0-beta11"},{"introduced":"3.0.0-beta12"},{"last_affected":"3.0.0-beta12"},{"introduced":"3.0.0-beta13"},{"last_affected":"3.0.0-beta13"},{"introduced":"3.0.0-beta14"},{"last_affected":"3.0.0-beta14"},{"introduced":"3.0.0-beta15"},{"last_affected":"3.0.0-beta15"},{"introduced":"3.0.0-beta16"},{"last_affected":"3.0.0-beta16"},{"introduced":"3.0.0-beta16\\.1"},{"last_affected":"3.0.0-beta16\\.1"},{"introduced":"3.0.0-beta16\\.2"},{"last_affected":"3.0.0-beta16\\.2"},{"introduced":"3.0.0-beta16\\.3"},{"last_affected":"3.0.0-beta16\\.3"},{"introduced":"3.0.0-beta16\\.4"},{"last_affected":"3.0.0-beta16\\.4"},{"introduced":"3.0.0-beta16\\.5"},{"last_affected":"3.0.0-beta16\\.5"},{"introduced":"3.0.0-beta16\\.6"},{"last_affected":"3.0.0-beta16\\.6"},{"introduced":"3.0.0-beta16\\.7"},{"last_affected":"3.0.0-beta16\\.7"},{"introduced":"3.0.0-beta16\\.8"},{"last_affected":"3.0.0-beta16\\.8"},{"introduced":"3.0.0-beta17"},{"last_affected":"3.0.0-beta17"},{"introduced":"3.0.0-beta17\\.1"},{"last_affected":"3.0.0-beta17\\.1"},{"introduced":"3.0.0-beta17\\.2"},{"last_affected":"3.0.0-beta17\\.2"},{"introduced":"3.0.0-beta17\\.3"},{"last_affected":"3.0.0-beta17\\.3"},{"introduced":"3.0.0-beta17\\.4"},{"last_affected":"3.0.0-beta17\\.4"},{"introduced":"3.0.0-beta17\\.5"},{"last_affected":"3.0.0-beta17\\.5"},{"introduced":"3.0.0-beta17\\.6"},{"last_affected":"3.0.0-beta17\\.6"},{"introduced":"3.0.0-beta17\\.7"},{"last_affected":"3.0.0-beta17\\.7"},{"introduced":"3.0.0-beta2"},{"last_affected":"3.0.0-beta2"},{"introduced":"3.0.0-beta3"},{"last_affected":"3.0.0-beta3"},{"introduced":"3.0.0-beta4"},{"last_affected":"3.0.0-beta4"},{"introduced":"3.0.0-beta5"},{"last_affected":"3.0.0-beta5"},{"introduced":"3.0.0-beta6"},{"last_affected":"3.0.0-beta6"},{"introduced":"3.0.0-beta7"},{"last_affected":"3.0.0-beta7"},{"introduced":"3.0.0-beta8"},{"last_affected":"3.0.0-beta8"},{"introduced":"3.0.0-beta9"},{"last_affected":"3.0.0-beta9"}],"source":"CPE_STRING","vendor_product":"strapi:strapi","cpes":["cpe:2.3:a:strapi:strapi:3.0.0:alpha10.1:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha10.2:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha10.3:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha11.1:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha11.2:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha11.3:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha11:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha12.1.3:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha12.1:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha12.2:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha12.3:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha12.4:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha12.5:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha12.6:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha12.7.1:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha12.7:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha12:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha13.0.1:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha13.1:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha13:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha14.1.1:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha14.1:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha14.2:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha14.3:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha14.4.0:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha14.5:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha14:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha15:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha16:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha17:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha18:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha19:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha20:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha21:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha22:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha23.1:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha23:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha24.1:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha24:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha25.1:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha25.2:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha25:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha26.1:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha26.2:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha26:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha4.8:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha4:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha5.3:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha5.5:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha6.3:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha6.4:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha6.7:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha7.2:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha7.3:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha8.3:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha8:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha9.1:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha9.2:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha9:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:beta0:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:beta10:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:beta11:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:beta12:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:beta13:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:beta14:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:beta15:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:beta16.1:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:beta16.2:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:beta16.3:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:beta16.4:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:beta16.5:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:beta16.6:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:beta16.7:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:beta16.8:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:beta16:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:beta17.1:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:beta17.2:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:beta17.3:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:beta17.4:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:beta17.5:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:beta17.6:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:beta17.7:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:beta17:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:beta1:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:beta2:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:beta3:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:beta4:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:beta5:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:beta6:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:beta7:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:beta8:*:*:*:*:*:*","cpe:2.3:a:strapi:strapi:3.0.0:beta9:*:*:*:*:*:*"]}]},"references":[{"type":"FIX","url":"https://github.com/strapi/strapi/pull/4636"},{"type":"EVIDENCE","url":"http://packetstormsecurity.com/files/163940/Strapi-3.0.0-beta.17.7-Remote-Code-Execution.html"},{"type":"EVIDENCE","url":"http://packetstormsecurity.com/files/163950/Strapi-CMS-3.0.0-beta.17.4-Remote-Code-Execution.html"},{"type":"EVIDENCE","url":"https://bittherapy.net/post/strapi-framework-remote-code-execution/"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/strapi/strapi","events":[{"introduced":"0"},{"last_affected":"3493c76c1fbb33d4e435d592c6df967bf5dcb90b"}],"database_specific":{"cpe":"cpe:2.3:a:strapi:strapi:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"last_affected":"1.6.4"}],"source":"CPE_RANGE"}}],"versions":["v1.6.4","v1.6.3","v1.6.2","v1.6.1","v1.6.0","v1.5.7","v1.5.4","v1.5.3","v1.5.2","v1.5.1","v1.5.0","v1.4.1","v1.4.0","v1.3.1","v1.3.0","v1.2.0","v1.1.0","v1.0.6","v1.0.5","v1.0.1","v1.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-19609.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"}]}