CVE-2019-5485: gitlabhook NPM package command injection via repository name

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityCVSS 10.0 with no authentication or interaction required, public exploit references, and very high EPSS make this an urgent fix for any deployment still running gitlabhook 0.0.17.

What it is

The NPM package gitlabhook version 0.0.17 passes the repository name into a shell command without sanitization, allowing OS command injection. Because the package is used to handle GitLab webhooks, any attacker able to influence the repository name can execute arbitrary commands on the host running the hook handler.

Impact

An attacker gains arbitrary command execution with the privileges of the gitlabhook process, which can lead to full host compromise, data theft, or lateral movement. The CVSS scope change indicates impact can extend beyond the vulnerable component.

Attack surface

Reachable over the network through the webhook handling path; the CVSS vector shows no privileges or user interaction required. The repository name is the injection point, so any party able to set or influence that value can reach the flaw.

Exploitation

Public exploit references exist (Packet Storm and HackerOne reports tagged Exploit), and EPSS is 0.58799 at the 99th percentile, indicating high predicted exploitation activity. It is not listed in CISA KEV.

What to do

• Upgrade gitlabhook to a version later than 0.0.17 if one is available; if no fixed version exists, remove or replace the package.
• Avoid passing repository names or other webhook-supplied strings into shell commands; use argument-array execution instead of shell interpolation.
• Run the gitlabhook process with least privilege and isolate it from sensitive hosts and credentials.
• Restrict who can create or rename repositories that feed the webhook handler, and validate/sanitize repository names before use.

Detection

• Monitor gitlabhook process command lines and child processes for unexpected shell invocations or unusual commands.
• Alert on webhook requests containing shell metacharacters (;, |, $(), backticks) in repository name fields.
• Audit logs for repository names containing suspicious characters or command fragments around the time of webhook processing.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.