CVE-2019-5485

The CVE-2019-5485 issue affects the npm package gitlabhook v0.0.17, where the repository.name field in a POST body is concatenated into an exec call without sanitization, enabling remote code execution. Exploit examples in connected data show an attacker can inject commands (e.g., creating /tmp/p...