{"action":"Upgrade strapi to 3.0.0-beta.17.8 or later.","affected":[{"fixed":"3.0.0-beta.17.8","introduced":"0"}],"component":"strapi","cve_ids":["CVE-2019-19609"],"ecosystem":"npm","epss":0.54081,"exploited":false,"fixed_versions":["3.0.0-beta.17.8"],"ghsa_id":"GHSA-9p2w-rmx4-9mw7","id":"tcs_01M5KFGCQWWXPK711K0BFYHQ5B","modified_at":"2025-12-29T16:10:52.382625Z","published_at":"2020-09-04T16:54:02Z","references":["https://osv.dev/vulnerability/GHSA-9p2w-rmx4-9mw7","https://nvd.nist.gov/vuln/detail/CVE-2019-19609","https://github.com/strapi/strapi/pull/4636","https://bittherapy.net/post/strapi-framework-remote-code-execution","https://github.com/strapi/strapi","https://www.npmjs.com/advisories/1424","http://packetstormsecurity.com/files/163940/Strapi-3.0.0-beta.17.7-Remote-Code-Execution.html","http://packetstormsecurity.com/files/163950/Strapi-CMS-3.0.0-beta.17.4-Remote-Code-Execution.html"],"severity":{"label":"high","score":7.2},"sources":[{"source":"osv","source_id":"GHSA-9p2w-rmx4-9mw7","url":"https://osv.dev/vulnerability/GHSA-9p2w-rmx4-9mw7"}],"summary":"Command Injection in strapi"}