CVE-2019-5413: Morgan Project Morgan

Critical severity, CVSS 9.8. EPSS: 3.4% chance of exploitation in the next 30 days.

An attacker can use the format parameter to inject arbitrary commands in the npm package morgan < 1.9.1.

Affected products

• Morgan Project Morgan: before 1.9.1 (fixed in 1.9.1)

Published 2019-03-21. Last modified 2026-06-17.