CVE-2019-18413

In TypeStack class-validator 0.10.2, validate() input validation can be bypassed because certain internal attributes can be overwritten via a conflicting name. Even though there is an optional forbidUnknownValues parameter that can be used to reduce the risk of this bypass, this option is not documented and thus most developers configure input validation in the vulnerable default manner. With this vulnerability, attackers can launch SQL Injection or XSS attacks by injecting arbitrary malicious input. NOTE: a software maintainer agrees with the "is not documented" finding but suggests that much of the responsibility for the risk lies in a different product.

• CWE-79
• CWE-89

• https://github.com/typestack/class-validator#passing-optionsThird Party Advisory
• https://github.com/typestack/class-validator/issues/1422#issuecomment-1344635415Issue Tracking, Release Notes, Third Party Advisory
• https://github.com/typestack/class-validator/issues/438Exploit, Issue Tracking, Third Party Advisory
• https://github.com/typestack/class-validator/issues/438#issuecomment-964728471Exploit, Issue Tracking, Third Party Advisory
• https://github.com/typestack/class-validator#passing-optionsThird Party Advisory
• https://github.com/typestack/class-validator/issues/1422#issuecomment-1344635415Issue Tracking, Release Notes, Third Party Advisory
• https://github.com/typestack/class-validator/issues/438Exploit, Issue Tracking, Third Party Advisory
• https://github.com/typestack/class-validator/issues/438#issuecomment-964728471Exploit, Issue Tracking, Third Party Advisory

Published

Oct 24, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-1840A vulnerability in the DHCPv6 input packet processor of Cisc…8.6
• CVE-2019-18408archive_read_format_rar_read_data in archive_read_support_fo…7.5
• CVE-2019-18409The ruby_parser-legacy (aka legacy) gem 1.0.0 for Ruby allow…7.8
• CVE-2019-1841A vulnerability in the Software Image Management feature of …6.5
• CVE-2019-18411Zoho ManageEngine ADSelfService Plus 5.x through 5803 has CS…8.8
• CVE-2019-18412JetBrains IDETalk plugin before version 193.4099.10 allows X…7.5
• CVE-2019-18414Sourcecodester Restaurant Management System 1.0 is affected …8.8
• CVE-2019-18415Sourcecodester Restaurant Management System 1.0 allows XSS v…6.1
• CVE-2019-18416Sourcecodester Restaurant Management System 1.0 allows XSS v…6.1
• CVE-2019-18417Sourcecodester Restaurant Management System 1.0 allows an au…8.8
• CVE-2019-18418clonos.php in ClonOS WEB control panel 19.09 allows remote a…9.8
• CVE-2019-18419A cross-site scripting (XSS) vulnerability in index.php in C…6.1