CVE-2019-1010306

Slanger Arbitrary command execution

9.8 CriticalFix available

CVE-2019-1010306 is a critical vulnerability (CVSS 9.8) in Slanger, published July 15, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.04%, the 90th percentile. Fixed in slanger 0.6.1.

Slanger 0.6.0 is affected by: Remote Code Execution (RCE). The impact is: A remote attacker can execute arbitrary commands by sending a crafted request to the server. The component is: Message handler & request validator. The attack vector is: Remote unauthenticated. The fixed version is: after commit 5267b455caeb2e055cccf0d2b6a22727c111f5c3.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

4.04%Up 3.1 points since Apr 14, 2021

What each source reports

NVD Score used 9.8

Record: CVE-2019-1010306
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-502
Updated: 2026-11-02

CVE List No score

Record: CVE-2019-1010306
Updated: 2026-11-02

EUVDEUVD-2019-0604 No score

Record: EUVD-2019-0604
Updated: 2026-11-03

GitHub AdvisoriesGHSA-rg32-m3hf-772v 9.8

Slanger Arbitrary command execution

Slanger 0.6.0 is affected by Remote Code Execution (RCE). The impact is A remote attacker can execute arbitrary commands by sending a crafted request to the server. The component is Message handler & request validator. The attack vector is Remote unauthenticated. The fixed version is after commit 5267b455caeb2e055cccf0d2b6a22727c111f5c3.

Record: GHSA-rg32-m3hf-772v
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-502
Updated: 2026-11-02

OSV 9.8

Record: CVE-2019-1010306
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVGHSA-rg32-m3hf-772v 9.8