Loading
The Strapi framework before 3.0.0-beta.17.8 is vulnerable to Remote Code Execution in the Install and Uninstall Plugin components of the Admin panel, because it does not sanitize the plugin name, and attackers can inject arbitrary shell commands to be executed by the execa function.
Use CWE-78, Strapi vendor hub and Strapi product page to widen CVE-2019-19609 into its surrounding weakness, vendor, and product context.
Compare it with CVE-2024-37818, CVE-2024-56143 and CVE-2023-39345 for nearby disclosures in the same product family.