---
id: CVE-2019-5413
title: >-
  An attacker can use the format parameter to inject arbitrary commands in the
  npm package morgan < 1.9.1.
summary: >-
  An attacker can use the format parameter to inject arbitrary commands in the
  npm package morgan < 1.9.1.
severity: none
cwe:
  - CWE-94
product: morgan
affected:
  - morgan < 1.9.1
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-11-02T17:49:26.998689Z'
exploitAvailable: true
published: '2019-03-17'
updated: '2026-11-02'
sourceUpdated: '2026-11-02T17:49:40.683Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2019-5413'
references:
  - url: 'https://hackerone.com/reports/390881'
  - url: >-
      https://lists.apache.org/thread.html/r8ba4c628fba7181af58817d452119481adce4ba92e889c643e4c7dd3%40%3Ccommits.netbeans.apache.org%3E
    label: >-
      [netbeans-commits] 20200429 [jira] [Created] (NETBEANS-4280) cleanup
      potential security breaches
  - url: >-
      https://lists.apache.org/thread.html/rb5ac16fad337d1f3bb7079549f97d8166d0ef3082629417c39f12d63%40%3Cnotifications.netbeans.apache.org%3E
    label: >-
      [netbeans-notifications] 20200429 [GitHub] [netbeans] BradWalker opened a
      new pull request #2110: [NETBEANS-4280] - cleanup potential security
      breaches
tags:
  - cve.org
  - exploit-available
epss: 0.03399
epssPercentile: 0.88914
exploits:
  github: 3
  githubRepos:
    - 'https://github.com/forse01/CVE-2019-5413-NetBeans'
    - 'https://github.com/forse01/CVE-2019-5413-NetBeans-NoJson'
    - 'https://github.com/crstaicu/CVE-2019-5413'
  checkedAt: '2026-11-07T17:39:37.757Z'
ingestedAt: '2026-11-05T19:30:42.751Z'
---

## Overview

An attacker can use the format parameter to inject arbitrary commands in the npm package morgan < 1.9.1.

## Affected

- `morgan < 1.9.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.