Duplicate Advisory: OS Command Injection in Strapi

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-9p2w-rmx4-9mw7. This link is maintained to preserve external references. Original Description The Strapi framework before 3.0.0-beta.17.8 is vulnerable to Remote Code Execution in the Install and Uninstall Plugi...

CVE-2019-19609: Improper Neutralization of Special Elements used in an OS Command

The Strapi framework before 3.0.0-beta.17.8 is vulnerable to Remote Code Execution in the Install and Uninstall Plugin components of the Admin panel, because it does not sanitize the plugin name, and attackers can inject arbitrary shell commands to be executed by the execa function...

PT-2019-15885

Name of the Vulnerable Software and Affected Versions Strapi framework versions prior to 3.0.0-beta.17.8 Description The issue allows for Remote Code Execution in the Install and Uninstall Plugin components of the Admin panel. This is due to the lack of sanitization of the plugin name, enabling...