CVE-2019-10788

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

im-metadata through 3.0.1 allows remote attackers to execute arbitrary commands via the "exec" argument. It is possible to inject arbitrary commands as part of the metadata options which is given to the "exec" function.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
n/a	im-metadata	All versions

References

https://github.com/Turistforeningen/node-im-metadata/commit/ea15dddbe0f65694bfde36b78dd488e90f246639Patch, Third Party Advisory
https://snyk.io/vuln/SNYK-JS-IMMETADATA-544184Exploit, Patch, Third Party Advisory
https://github.com/Turistforeningen/node-im-metadata/commit/ea15dddbe0f65694bfde36b78dd488e90f246639Patch, Third Party Advisory
https://snyk.io/vuln/SNYK-JS-IMMETADATA-544184Exploit, Patch, Third Party Advisory

Timeline

Published: Feb 4, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-107899.8All versions of curling.js are vulnerable to Command Injection via the run function. The command argument can be controlled by users without CVE-2019-10796.5An information disclosure vulnerability exists when Visual Studio improperly parses XML input in certain settings files, aka 'Visual Studio CVE-2019-107907.5taffydb npm module, vulnerable in all versions up to and including 2.7.3, allows attackers to forge adding additional properties into user-i CVE-2019-107919.8promise-probe before 0.10.0 allows remote attackers to perform a command injection attack. The file, outputFile and options functions can be CVE-2019-107926.3bodymen before 1.1.1 is vulnerable to Prototype Pollution. The handler function could be tricked into adding or modifying properties of Obje CVE-2019-107936.3dot-object before 2.1.3 is vulnerable to Prototype Pollution. The set function could be tricked into adding or modifying properties of Objec CVE-2019-107946.3All versions of component-flatten are vulnerable to Prototype Pollution. The a function could be tricked into adding or modifying properties CVE-2019-107956.3undefsafe before 2.0.3 is vulnerable to Prototype Pollution. The 'a' function could be tricked into adding or modifying properties of Object CVE-2019-107969.8rpi through 0.0.3 allows execution of arbritary commands. The variable pinNumbver in function GPIO within src/lib/gpio.js is used as part of CVE-2019-107976.5Netty in WSO2 transport-http before v6.3.1 is vulnerable to HTTP Response Splitting due to HTTP Header validation being disabled.CVE-2019-107985.3rdf-graph-array through 0.3.0-rc6 manipulation of JavaScript objects resutling in Prototype Pollution. The rdf.Graph.prototype.add method co CVE-2019-107998.2compile-sass prior to 1.0.5 allows execution of arbritary commands. The function "setupCleanupOnExit(cssPath)" within "dist/index.js" is exe