CVE-2019-11354

The client in Electronic Arts (EA) Origin 10.5.36 on Windows allows template injection in the title parameter of the Origin2 URI handler. This can be used to escape the underlying AngularJS sandbox and achieve remote code execution via an origin2://game/launch URL for QtApplication QDesktopServices communication.

• CWE-74

• http://gamasutra.com/view/news/340907/A_nowfixed_Origin_vulnerability_potentially_opened_the_client_to_hackers.phpThird Party Advisory
• http://packetstormsecurity.com/files/153375/dotProject-2.1.9-SQL-Injection.htmlExploit, Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/153485/EA-Origin-Template-Injection-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
• https://blog.underdogsecurity.com/rce_in_origin_client/Broken Link
• https://gizmodo.com/ea-origin-users-update-your-client-now-1834079604Exploit, Third Party Advisory
• https://techcrunch.com/2019/04/16/ea-origin-bug-exposed-hackers/Exploit, Third Party Advisory
• https://www.golem.de/news/sicherheitsluecke-ea-origin-fuehrte-schadcode-per-link-aus-1904-140738.htmlPress/Media Coverage, Third Party Advisory
• https://www.pcmag.com/news/367801/security-flaw-allowed-any-app-to-run-using-eas-origin-clienPress/Media Coverage, Third Party Advisory
• https://www.techradar.com/news/major-security-flaw-found-in-ea-origin-gaming-clientPress/Media Coverage, Third Party Advisory
• https://www.thesun.co.uk/tech/8877334/sims-4-battlefield-fifa-origin-hackers/Press/Media Coverage, Third Party Advisory
• https://www.trustedreviews.com/news/time-update-origin-eas-game-client-security-risk-just-installed-3697942Third Party Advisory
• https://www.vg247.com/2019/04/17/ea-origin-security-flaw-run-malicious-code-fixed/Third Party Advisory
• http://gamasutra.com/view/news/340907/A_nowfixed_Origin_vulnerability_potentially_opened_the_client_to_hackers.phpThird Party Advisory
• http://packetstormsecurity.com/files/153375/dotProject-2.1.9-SQL-Injection.htmlExploit, Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/153485/EA-Origin-Template-Injection-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
• https://blog.underdogsecurity.com/rce_in_origin_client/Broken Link
• https://gizmodo.com/ea-origin-users-update-your-client-now-1834079604Exploit, Third Party Advisory
• https://techcrunch.com/2019/04/16/ea-origin-bug-exposed-hackers/Exploit, Third Party Advisory
• https://www.golem.de/news/sicherheitsluecke-ea-origin-fuehrte-schadcode-per-link-aus-1904-140738.htmlPress/Media Coverage, Third Party Advisory
• https://www.pcmag.com/news/367801/security-flaw-allowed-any-app-to-run-using-eas-origin-clienPress/Media Coverage, Third Party Advisory
• https://www.techradar.com/news/major-security-flaw-found-in-ea-origin-gaming-clientPress/Media Coverage, Third Party Advisory
• https://www.thesun.co.uk/tech/8877334/sims-4-battlefield-fifa-origin-hackers/Press/Media Coverage, Third Party Advisory
• https://www.trustedreviews.com/news/time-update-origin-eas-game-client-security-risk-just-installed-3697942Third Party Advisory
• https://www.vg247.com/2019/04/17/ea-origin-security-flaw-run-malicious-code-fixed/Third Party Advisory

Published

Apr 19, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-11344data/inc/files.php in Pluck 4.7.8 allows remote attackers to…
• CVE-2019-11345Citrix SD-WAN Center 10.2.x before 10.2.1 and NetScaler SD-W…6.1
• CVE-2019-1135Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-11350CloudBees Jenkins Operations Center 2.150.2.3, when an expir…
• CVE-2019-11351TeamSpeak 3 Client before 3.2.5 allows remote code execution…
• CVE-2019-11353The EnGenius EWS660AP router with firmware 2.0.284 allows an…
• CVE-2019-11355An issue was discovered in Poly (formerly Polycom) HDX 3.1.1…7.2
• CVE-2019-11356The CalDAV feature in httpd in Cyrus IMAP 2.5.x through 2.5.…9.8
• CVE-2019-11358jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and ot…6.1
• CVE-2019-11359Cross-site scripting (XSS) vulnerability in display.php in I…
• CVE-2019-1136An elevation of privilege vulnerability exists in Microsoft …
• CVE-2019-11360A buffer overflow in iptables-restore in netfilter iptables …4.2