CVE-2019-15597

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A code injection exists in node-df v0.1.4 that can allow an attacker to remote code execution by unsanitized input.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published
Dec 18, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-155989.8A Code Injection exists in treekill on Windows which allows a remote code execution when an attacker is able to control the input into the cCVE-2019-155999.8A Code Injection exists in tree-kill on Windows which allows a remote code execution when an attacker is able to control the input into the CVE-2019-156007.5A Path traversal exists in http_server which allows an attacker to read arbitrary system files.CVE-2019-156026.1The fileview package v0.1.6 has inadequate output encoding and escaping, which leads to a stored Cross-Site Scripting (XSS) vulnerability inCVE-2019-156036.1The seefl package v0.1.1 is vulnerable to a stored Cross-Site Scripting (XSS) vulnerability via a malicious filename rendered in a directoryCVE-2019-156047.5Improper Certificate Validation in Node.js 10, 12, and 13 causes the process to abort when sending a crafted X.509 certificateCVE-2019-156059.8HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformedCVE-2019-156069.8Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value comparisoCVE-2019-156075.4A stored XSS vulnerability is present within node-red (version: <= 0.20.7) npm package, which is a visual tool for wiring the Internet of ThCVE-2019-156085.9The package integrity validation in yarn < 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a package to cacCVE-2019-156099.8The kill-port-process package version < 2.2.0 is vulnerable to a Command Injection vulnerability.CVE-2019-156104.3Improper authorization in the Circles app 0.17.7 causes retaining access when an email address was removed from a circle.
CVE-2019-15597: Critical severity, CVSS 9.8 | Vulnix