---
title: "CX-2019-4298"
date: "2019-09-26T07:00:00+00:00"
url: "https://checkmarx.com/zero/vulnerabilities/cx-2019-4298/"
---

# CX-2019-4298

[Disclosed vulnerabilities](https://checkmarx.com/zero/vulnerabilities/)

Fixed: Sep 26, 2019

No CVE assigned  **Published:** Sep 26, 2019

4.5 Medium Severity Command Injection javascript js PROTOTYPE-POLLUTION

DT Dor Tumarkin  Reported by Checkmarx Zero

Details Overview

## Summary

A local code/OS command execution vulnerability was discovered in Commander.js, in the “parse()” method. Given a permission to write and set permissions on a file in the same working directory as the application, and given the ability to pass the value `__proto__` to the “parse()” method, an attacker can bypass checks against values set in \_execs\[\] to execute an external file which was not intended.

## Product

Commander.js before version 2.20.1 and 3.x before 3.0.2.

## Impact

With the right conditions an attacker could run ability commands on the server.

## Steps to reproduce

1. Create a file named `poc-__proto__` with the shell command in it with a given execution permissions (+x)
2. Create `poc.js` with the code:

    ```
    var program = require('commander');
    console.log(program.parse(process.argv));
    ```
3. Run `Node poc.js __proto__`

### Expected result:

The shell command in the file `poc-__proto__` will run.

## Remediation

Update Commander.js plugin to 2.20.1 or 3.0.2 or above.

## Credit

This issue was discovered and reported by Checkmarx Security Researcher Dor Tumarkin.

## Resources

1. [Pull request](https://github.com/tj/commander.js/pull/1056)
2. [2544df8](https://github.com/tj/commander.js/commit/2544df81b478a4afe15560f27b3575aa3a1581c4)

0  Medium Severity CVSS v3.1 Score

   4.5

CVSS v3.1 Vectors- Attack Vector: Local
- Attack Complexity: High
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: Low

Advisory Timeline1. Discovered Sep 22, 2019 Notified the maintainer
2. Fixed Sep 26, 2019 Fix commit got released

## Explore more findings

[27 Nov 2025 CVE-2025-34281  Stored Cross-Site Scripting (XSS) in ThingsBoard   6.2  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-34281/) [17 Jan 2025 CVE-2025-0825  HTTP Response Splitting in cpp-httplib   6.9  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-0825/) [17 Jun 2025 CVE-2025-6050  Stored Cross-Site Scripting (XSS) in Mezzanine CMS Admin Interface   4.8  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-6050/) [12 Dec 2024 CVE-2024-8374  Code Injection in UltiMaker Cura   7.8  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-8374/) [14 Nov 2024 CVE-2024-52526  Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-52526/) [14 Nov 2024 CVE-2024-51497  Stored Cross-site Scripting in @LibreNMS/LibreNMS Custom OID Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51497/) [14 Nov 2024 CVE-2024-51496  Reflected Cross-site Scripting in @LibreNMS/LibreNMS /wireless and /health endpoints   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51496/) [  14 Nov 2024 CVE-2024-51495  Stored Cross-site Scripting in @LibreNMS/LibreNMS Device Overview `overwrite\_ip` Field   7.5  Visit the page ](https://checkmarx.com/zero/vulnerabilities/cve-2024-51495/) [14 Nov 2024 CVE-2024-51494  Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51494/) [14 Nov 2024 CVE-2024-50352  Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Section of Device Overview   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50352/) [14 Nov 2024 CVE-2024-50351  Reflected Cross-site Scripting in @LibreNMS/LibreNMS Logs Tab   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50351/) [14 Nov 2024 CVE-2024-50350  Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings Port Group   7.5  Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50350/)