VULNERABILITY INTELLIGENCE

CVE-2019-13638

CVSS score7.8 HIGH
EPSS probability4.49%
CISA KEVNot currently listed
Published2019-07-26
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Description

GNU patch through 2.7.6 is vulnerable to OS shell command injection that can be exploited by opening a crafted patch file that contains an ed style diff payload with shell metacharacters. The ed editor does not need to be present on the vulnerable system. This is different from CVE-2018-1000156.

Weakness classification

  • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Primary references