Elasticsearch Logstash 1.0.14 through 1.4.x before 1.4.2 allows remote attackers to execute arbitrary commands via a crafted event in (1) za

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• elastic logstash1.0.14
• elastic logstash1.0.15
• elastic logstash1.0.16
• elastic logstash1.0.17
• elastic logstash1.1.0
• elastic logstash1.1.0.1
• elastic logstash1.1.1
• elastic logstash1.1.10
• elastic logstash1.1.11
• elastic logstash1.1.12
• elastic logstash1.1.13
• elastic logstash1.1.2
• elastic logstash1.1.3
• elastic logstash1.1.4
• elastic logstash1.1.5
• elastic logstash1.1.6
• elastic logstash1.1.7
• elastic logstash1.1.8
• elastic logstash1.1.9
• elastic logstash1.2.1

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2019-7612A sensitive data disclosure flaw was found in the way Logstash versions before 5.6.15 and 6.6.1 logs malformed URLs.
  40Plan
• CVE-2026-33466Improper Limitation of a Pathname to a Restricted Directory in Logstash Leading to Arbitrary File Write
  39Monitor
• CVE-2019-7620Logstash versions before 7.4.1 and 6.8.4 contain a denial of service flaw in the Logstash Beats input plugin.
  31Monitor
• CVE-2015-5378Logstash 1.5.x before 1.5.3 and 1.4.x before 1.4.4 allows remote attackers to read communications between Logstash Forwarder agent and Logst
  31Monitor
• CVE-2016-1000221Logstash prior to version 2.3.4, Elasticsearch Output plugin would log to file HTTP authorization headers which could contain sensitive info
  31Monitor
• CVE-2016-10363Logstash versions prior to 2.3.3, when using the Netflow Codec plugin, a remote attacker crafting malicious Netflow v5, Netflow v9 or IPFIX
  30Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

User input is inserted as text into a shell command. The shell may interpret special characters in the input as part of the command.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1const host = req.body.host;2exec("ping -c 1 " + host, onResult);

1const host = req.body.host;2if (!/^[a-z0-9.-]{1,253}$/i.test(host)) return res.sendStatus(400);3execFile("ping", ["-c", "1", host], onResult);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.