CVE-2019-10789: Curling Project Curling

Critical severity, CVSS 9.8. EPSS: 4.9% chance of exploitation in the next 30 days.

All versions of curling.js are vulnerable to Command Injection via the run function. The command argument can be controlled by users without any sanitization.

Affected products

Published 2020-02-06. Last modified 2026-06-17.