CVE-2019-19609: Strapi Admin panel plugin name command injection RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityRemote code execution with a public exploit and very high EPSS, but it requires an authenticated admin account, which limits exposure.

What it is

Strapi before 3.0.0-beta.17.8 fails to sanitize the plugin name in the Admin panel Install and Uninstall Plugin components, allowing shell command injection into the execa call. An authenticated admin can execute arbitrary commands on the server, turning a content management interface into a remote code execution path.

Impact

An attacker with Admin panel access gains arbitrary command execution on the host running Strapi, enabling data theft, persistence or full server compromise.

Attack surface

Reached over the network through the Strapi Admin panel plugin install/uninstall functionality. The CVSS vector requires high privileges (PR:H) and no user interaction, so a valid admin-level account is needed.

Exploitation

Not listed in CISA KEV, but EPSS is 0.54081 (99th percentile) and multiple references are tagged Exploit, indicating public exploit code exists.

What to do

• Upgrade Strapi to 3.0.0-beta.17.8 or later, which includes the fix in PR 4636.
• If immediate upgrade is not possible, restrict Admin panel access to trusted networks and disable plugin install/uninstall where feasible.
• Enforce least privilege on Strapi admin accounts and audit who holds admin roles.
• Monitor and rotate credentials for any admin account that may have been exposed.
• Review server logs for unexpected child processes spawned by the Strapi Node.js process.

Detection

• Alert on Strapi admin API calls to plugin install/uninstall endpoints, especially with shell metacharacters in the plugin name.
• Monitor for child processes (sh, bash, curl, wget) spawned by the Node.js/Strapi process.
• Search application and system logs for command strings or outbound connections originating from the Strapi host after admin plugin actions.
• Baseline normal admin plugin activity and flag installs of unknown or unexpected plugins.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.