CVE-2019-12966: Fehelper Project Fehelper

Critical severity, CVSS 9.8. EPSS: 2.4% chance of exploitation in the next 30 days.

FeHelper through 2019-06-19 allows arbitrary code execution during a JSON format operation, as demonstrated by the {"a":(function(){confirm(1)})()} input.

Affected products

• Fehelper Project Fehelper: up to and including 2019-06-19

Published 2019-06-26. Last modified 2026-06-17.