CVE-2019-11594

HIGH

AdBlock < 3.45.0 - Remote Code Execution via $rewrite Filter Option

Title source: llm
STIX 2.1

Description

In AdBlock before 3.45.0, the $rewrite filter option allows filter-list maintainers to run arbitrary code in a client-side session when a web service loads a script for execution using XMLHttpRequest or Fetch, and the script origin has an open redirect.

References (3)

Core 3
Core References
Mitigation, Third Party Advisory x_refsource_misc
https://armin.dev/blog/2019/04/adblock-plus-code-injection/
Third Party Advisory x_refsource_misc
https://news.ycombinator.com/item?id=19666504

Scores

CVSS v3 8.1
EPSS 0.0239
EPSS Percentile 81.9%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-94
Status published
Products (1)
getadblock/adblock < 3.45.0
Published Apr 29, 2019
Tracked Since Feb 18, 2026