{"id":"CVE-2019-19010","aliases":["DEBIAN-CVE-2019-19010","EUVD-2019-0075","GHSA-6g88-vr3v-76mf","PYSEC-2019-102","UBUNTU-CVE-2019-19010"],"status":"published","title":"Eval injection in Supybot/Limnoria","description":"Eval injection in the Math plugin of Limnoria (before 2019.11.09) and Supybot (through 2018-05-09) allows remote unprivileged attackers to disclose information or possibly have unspecified other impact via the calc and icalc IRC commands.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02327,"percentile":0.83632,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-94"],"published":"2019-11-16T00:52:06Z","modified":"2026-11-09T10:45:07Z","fixes":[{"ecosystem":"PyPI","package":"limnoria","fixed_in":["2019.11.09"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"limnoria","fixed_in":["2019.11.09-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"limnoria","fixed_in":["2019.11.09-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"limnoria","fixed_in":["2019.11.09-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"limnoria","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2019.11.09"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"limnoria","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2019.11.09-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"limnoria","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2019.11.09-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"limnoria","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2019.11.09-1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"limnoria","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2019.11.09"}]}],"versions":["0.2016.03.21","2013-01-21T20:33:09+0100","2013-01-23T17:11:52+0100","2013-02-01T20:50:46+0100","2013-02-02T19:59:03+0100","2013-02-02T20:23:17+0100","2013-02-08T17:40:57+0000","2013-03-27T16:32:26+0100","2013-05-09T12:47:53+0200","2013-05-10T17:55:56+0200","2013-05-14T20:16:05+0200","2013-06-01T10:32:51+0200","2013-07-19T09:11:08+0000","2013-08-12T21:48:56+0200","2013-09-11T19-27-10","2013-12-23T17-51-15","2014-01-12T15-52-10","2014.03.03","2014.05.08","2014.05.17","2014.05.29","2014.06.04","2014.06.26","2014.07.19","2014.10.09","2014.11.24","2014.12.07","2014.12.22","2015.03.10","2015.04.29","2015.05.20","2015.07.08","2015.08.17","2015.08.29","2015.09.16","2015.10.04","2015.11.30","2015.12.02","2015.12.12","2016.01.05","2016.02.23","2016.02.24","2016.03.21","2016.03.21.1","2016.03.21.2","2016.05.06","2016.06.27","2016.06.29","2016.08.07","2016.09.26","2016.10.01","2016.10.02","2016.11.28","2016.12.08","2017.01.10","2017.03.30","2017.08.03","2017.08.18","2017.10.01","2018.01.25","2018.04.14","2018.06.20","2018.06.25","2018.09.01","2018.09.09","2018.12.19","2019.02.14","2019.02.21","2019.02.21.1","2019.02.22","2019.02.23","2019.05.28","2019.08.25","2019.09.08","2019.10.22"]},{"source":"osv","ecosystem":"PyPI","package":"limnoria","ranges":[{"type":"GIT","events":[{"introduced":"0"},{"fixed":"3848ae78de45b35c029cc333963d436b9d2f0a35"}]},{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2019.11.09"}]}],"versions":["2013-01-21T20:33:09+0100","2013-01-23T17:11:52+0100","2013-02-01T20:50:46+0100","2013-02-02T19:59:03+0100","2013-02-02T20:23:17+0100","2013-02-08T17:40:57+0000","2013-03-27T16:32:26+0100","2013-05-09T12:47:53+0200","2013-05-10T17:55:56+0200","2013-05-14T20:16:05+0200","2013-06-01T10:32:51+0200","2013-07-19T09:11:08+0000","2013-08-12T21:48:56+0200","2013-09-11T19-27-10","2013-12-23T17-51-15","2014-01-12T15-52-10","0.2016.03.21","2014.03.03","2014.05.08","2014.05.17","2014.05.29","2014.06.04","2014.06.26","2014.07.19","2014.10.09","2014.11.24","2014.12.07","2014.12.22","2015.03.10","2015.04.29","2015.05.20","2015.07.08","2015.08.17","2015.08.29","2015.09.16","2015.10.04","2015.11.30","2015.12.02","2015.12.12","2016.01.05","2016.02.23","2016.02.24","2016.03.21","2016.03.21.1","2016.03.21.2","2016.05.06","2016.06.27","2016.06.29","2016.08.07","2016.09.26","2016.10.01","2016.10.02","2016.11.28","2016.12.08","2017.01.10","2017.03.30","2017.08.03","2017.08.18","2017.10.01","2018.01.25","2018.04.14","2018.06.20","2018.06.25","2018.09.01","2018.09.09","2018.12.19","2019.02.14","2019.02.21","2019.02.21.1","2019.02.22","2019.02.23","2019.05.28","2019.08.25","2019.09.08","2019.10.22"]}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"limnoria_project","product":"limnoria"}],"references":[{"url":"https://github.com/ProgVal/Limnoria/wiki/math-eval-vulnerability","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://github.com/ProgVal/Limnoria/commit/3848ae78de45b35c029cc333963d436b9d2f0a35","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/54CQM2TEXRADLE77VOMCPHL5PBHR3ZWJ/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DRNOUHFEN75QAIKT4Y3HDN3TT5LSIWN2/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5P2AGND54UIJV3WHOYO2YINIXSDGAAPO/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-19010","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-6g88-vr3v-76mf","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/limnoria/PYSEC-2019-102.yaml","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/54CQM2TEXRADLE77VOMCPHL5PBHR3ZWJ","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5P2AGND54UIJV3WHOYO2YINIXSDGAAPO","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DRNOUHFEN75QAIKT4Y3HDN3TT5LSIWN2","tags":["web"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-19010","tags":["advisory"]},{"url":"https://github.com/ProgVal/Limnoria","tags":["package"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/54CQM2TEXRADLE77VOMCPHL5PBHR3ZWJ/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5P2AGND54UIJV3WHOYO2YINIXSDGAAPO/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DRNOUHFEN75QAIKT4Y3HDN3TT5LSIWN2/","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2019-19010","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-19010","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2019-19010","description":"Eval injection in the Math plugin of Limnoria (before 2019.11.09) and Supybot (through 2018-05-09) allows remote unprivileged attackers to disclose information or possibly have unspecified other impact via the calc and icalc IRC commands.","status":"published","published":"2019-11-16T00:52:06Z","modified":"2024-08-05T02:02:40.038Z","updated_at":"2026-11-02T14:20:20.74896Z"}],"euvd":[{"id":"EUVD-2019-0075","description":"Eval injection in the Math plugin of Limnoria (before 2019.11.09) and Supybot (through 2018-05-09) allows remote unprivileged attackers to disclose information or possibly have unspecified other impact via the calc and icalc IRC commands.","status":"published","published":"2019-11-16T00:52:06Z","modified":"2024-08-05T02:02:40Z","updated_at":"2026-11-03T02:40:26.778341Z"}],"ghsa":[{"id":"GHSA-6g88-vr3v-76mf","title":"Eval injection in Supybot/Limnoria","description":"Eval injection in the Math plugin of Limnoria (before 2019.11.09) and Supybot (through 2018-05-09) allows remote unprivileged attackers to disclose information or possibly have unspecified other impact via the calc and icalc IRC commands.","status":"published","published":"2019-11-20T01:31:31Z","modified":"2024-09-30T16:22:03Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:38:06.988799Z"}],"nvd":[{"id":"CVE-2019-19010","description":"Eval injection in the Math plugin of Limnoria (before 2019.11.09) and Supybot (through 2018-05-09) allows remote unprivileged attackers to disclose information or possibly have unspecified other impact via the calc and icalc IRC commands.","status":"published","published":"2019-11-16T01:15:10.217Z","modified":"2026-06-17T02:25:58.647Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:05:37.024431Z"}],"osv":[{"id":"CVE-2019-19010","description":"Eval injection in the Math plugin of Limnoria (before 2019.11.09) and Supybot (through 2018-05-09) allows remote unprivileged attackers to disclose information or possibly have unspecified other impact via the calc and icalc IRC commands.","status":"published","published":"2019-11-16T01:15:10.217Z","modified":"2026-11-10T02:45:16.98138983Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-09T10:53:57.550641Z"},{"id":"DEBIAN-CVE-2019-19010","description":"Eval injection in the Math plugin of Limnoria (before 2019.11.09) and Supybot (through 2018-05-09) allows remote unprivileged attackers to disclose information or possibly have unspecified other impact via the calc and icalc IRC commands.","status":"published","published":"2019-11-16T01:15:10.217Z","modified":"2026-09-21T07:02:33.738443616Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:31.867036Z"},{"id":"GHSA-6g88-vr3v-76mf","title":"Eval injection in Supybot/Limnoria","description":"Eval injection in the Math plugin of Limnoria (before 2019.11.09) and Supybot (through 2018-05-09) allows remote unprivileged attackers to disclose information or possibly have unspecified other impact via the calc and icalc IRC commands.","status":"published","published":"2019-11-20T01:31:31Z","modified":"2025-02-21T05:29:16.226177Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:46:39.618611Z"},{"id":"UBUNTU-CVE-2019-19010","description":"Eval injection in the Math plugin of Limnoria (before 2019.11.09) and Supybot (through 2018-05-09) allows remote unprivileged attackers to disclose information or possibly have unspecified other impact via the calc and icalc IRC commands.","status":"withdrawn","published":"2019-11-16T01:15:00Z","modified":"2026-02-12T06:29:09.224686Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:20.325378Z"},{"id":"PYSEC-2019-102","description":"Eval injection in the Math plugin of Limnoria (before 2019.11.09) and Supybot (through 2018-05-09) allows remote unprivileged attackers to disclose information or possibly have unspecified other impact via the calc and icalc IRC commands.","status":"published","published":"2019-11-16T01:15:00Z","modified":"2023-11-08T04:01:27.252439Z","updated_at":"2026-11-02T15:52:52.192131Z"}]}}