CVE-2019-5413

An attacker can use the format parameter to inject arbitrary commands in the npm package morgan < 1.9.1.

An attacker can use the format parameter to inject arbitrary commands in the npm package morgan < 1.9.1.

Verisons of `morgan` before 1.9.1 are vulnerable to code injection when user input is allowed into the filter or combined with a prototype pollution attack. ## Recommendation Update to version 1.9.1 or later.

Verisons of `morgan` before 1.9.1 are vulnerable to code injection when user input is allowed into the filter or combined with a prototype pollution attack. ## Recommendation Update to version 1.9.1 or later.

Un atacante puede emplear el parámetro format para inyectar comandos arbitrarios en el paquete de npm morgan, en versiones anteriores a la 1.9.1.