CVE-2019-5485
Command Injection in gitlabhook
NPM package gitlabhook version 0.0.17 is vulnerable to a Command Injection vulnerability. Arbitrary commands can be injected through the repository name.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
NPM package gitlabhook version 0.0.17 is vulnerable to a Command Injection vulnerability. Arbitrary commands can be injected through the repository name.
- Record
CVE-2019-5485- CVSS 3.1
- 10.0 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-78
- Updated
- 2026-11-02
CVE List No score
NPM package gitlabhook version 0.0.17 is vulnerable to a Command Injection vulnerability. Arbitrary commands can be injected through the repository name.
- Record
CVE-2019-5485- Weakness
- CWE-78
- Updated
- 2026-11-02
EUVDEUVD-2019-0652 No score
NPM package gitlabhook version 0.0.17 is vulnerable to a Command Injection vulnerability. Arbitrary commands can be injected through the repository name.
- Record
EUVD-2019-0652- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-549f-73hh-mj38
Command Injection in gitlabhook
All versions of gitlabhook are vulnerable to Command Injection. The package does not validate input the body of POST request and concatenates it to an exec call, allowing attackers to run arbitrary commands in the system.
Recommendation
No fix is currently available. Consider using an alternative package until a fix is made available.
- Record
GHSA-549f-73hh-mj38- CVSS 3.1
- 10.0 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-02
OSVGHSA-549f-73hh-mj38
Command Injection in gitlabhook
All versions of gitlabhook are vulnerable to Command Injection. The package does not validate input the body of POST request and concatenates it to an exec call, allowing attackers to run arbitrary commands in the system.
Recommendation
No fix is currently available. Consider using an alternative package until a fix is made available.
- Record
GHSA-549f-73hh-mj38- CVSS 3.1
- 10.0 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
gitlabhooknpm |
through 0.0.17 | None known |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | NPMJS gitlabhook 0.0.17 - 'repository' Remote Command Execution | 2019-09-25 |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-5485 is a critical vulnerability (CVSS 10.0) in Gitlabhook Project Gitlabhook, published September 13, 2019. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 58.8%, the 99th percentile. No source names a fixed version.