Command Injection
An attacker can use the format parameter to inject arbitrary commands in the npm package morgan.
Advisories for Npm/Morgan package
2019
An attacker can use the format parameter to inject arbitrary commands in the npm package morgan.