CVE-2019-15597

CRITICAL

node-df 0.1.4 - Remote Code Execution via Unsanitized Input

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2019-15597. PoCs published by AikidoSec.

AI-analyzed exploit summary This repository contains a functional exploit PoC for CVE-2019-15597, demonstrating command injection in the 'node-df' package via malicious input in the 'file' option. The PoC includes both vulnerable and protected test cases, with Docker setup for easy reproduction.

Description

A code injection exists in node-df v0.1.4 that can allow an attacker to remote code execution by unsanitized input.

Exploits (1)

github WORKING POC 6 stars

by AikidoSec · javascriptpoc

https://github.com/AikidoSec/zen-0-days/tree/main/node/CVE-2019-15597

View Code ZIP pw:eip

This repository contains a functional exploit PoC for CVE-2019-15597, demonstrating command injection in the 'node-df' package via malicious input in the 'file' option. The PoC includes both vulnerable and protected test cases, with Docker setup for easy reproduction.

Classification

Working Poc 95%

Attack Type

Rce

Complexity

Trivial

Reliability

Reliable

Target: node-df (Node.js package)

No auth needed

Prerequisites: Node.js environment · node-df package installed

MITRE ATT&CK

T1190 - Exploit Public-Facing Application T1059 - Command and Scripting Interpreter T1203 - Exploitation for Client Execution

devstral-2 · analyzed Feb 27, 2026 Full analysis →

References (1)

Core 1

Core References

Permissions Required, Third Party Advisory x_refsource_misc

https://hackerone.com/reports/703412

Scores

CVSS v3 9.8

EPSS 0.0274

EPSS Percentile 84.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-94

Status published

Products (2)

node-df_project/node-df 0.1.4

npm/node-df 0npm

Published Dec 18, 2019

Tracked Since Feb 18, 2026