Read the docs
TI-2019-08072 Aliases CVE-2019-10807GHSA-8cxp-cjm8-fj36

OS command injection in blamer

Priority MEDIUM 47CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-78.

Summary

Blamer versions prior to 1.0.1 allows execution of arbitrary commands. It is possible to inject arbitrary commands as part of the arguments provided to blamer.

Why it matters now

EPSS 0.0242 84th percentileScored 2026-11-07
Fix Fixed blamer: 1.0.1blamer (npm): 1.0.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—blamerbefore 1.0.11.0.1Patch availableCNA
—blamer (npm)before 1.0.11.0.1Patch availableGHSA-8cxp-cjm8-fj36
  • blamer Vendor— Affected before 1.0.1 Fixed in 1.0.1 Patch available CNA
  • blamer (npm) Vendor— Affected before 1.0.1 Fixed in 1.0.1 Patch available GHSA-8cxp-cjm8-fj36

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:blamer_project:blamer:*:*:*:*:*:node.js:*:*before 1.0.1VulnerableBlamer Project
  • cpe:2.3:a:blamer_project:blamer:*:*:*:*:*:node.js:*:* Versions before 1.0.1 Vulnerable ·Blamer Project

Remediation

  • Fix · CNA blamer Fixed in 1.0.1
  • Fix · GHSA-8cxp-cjm8-fj36 blamer (npm) Fixed in 1.0.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-10807
  2. 2026-10-03 Alias added: GHSA-8cxp-cjm8-fj36

References

Advisory 1

Other 3

  • TI-2023-11367 Versions of the package blamer before 1.0.4 are vulnerable to Arbitrary Argument… CVSS 3.1CRITICAL 9.1
  • TI-2020-06555 Code injection in blamer CVSS 3.1CRITICAL 9.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences