What’s Vulnerable › Vulnerabilities

CVE-2019-0542

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-01-09 · updated 2026-06-17
• Weakness: CWE-94

Description

A remote code execution vulnerability exists in Xterm.js when the component mishandles special characters, aka "Xterm Remote Code Execution Vulnerability." This affects xterm.js.

Affected products

• Red Hat OpenShift Container Platform 4.18: from 3.9 before 3.9.99; from 3.10 before 3.10.163; from 3.11 (excl.) before 3.11.104 — fixed in 3.10.163, 3.11.104, 3.9.99
• Xtermjs Xterm.Js: before 5.0.0 — fixed in 5.0.0

How to fix

Upgrade to a fixed version: Red Hat OpenShift Container Platform 4.18 3.10.163, 3.11.104, 3.9.99; Xtermjs Xterm.Js 5.0.0. Check the vendor advisory for mitigations.

References

• http://www.securityfocus.com/bid/106434
• https://access.redhat.com/errata/RHBA-2019:0959
• https://access.redhat.com/errata/RHSA-2019:1422
• https://access.redhat.com/errata/RHSA-2019:2551
• https://access.redhat.com/errata/RHSA-2019:2552
• https://github.com/xtermjs/xterm.js/releases
• http://www.securityfocus.com/bid/106434
• https://access.redhat.com/errata/RHBA-2019:0959
• https://access.redhat.com/errata/RHSA-2019:1422
• https://access.redhat.com/errata/RHSA-2019:2551
• https://access.redhat.com/errata/RHSA-2019:2552
• https://github.com/xtermjs/xterm.js/releases

Get alerted when CVE-2019-0542 or the next vulnerability affects your stack