Advisory Weakness Curation

Code Injection in morgan Verisons of `morgan` before 1.9.1 are vulnerable to code injection when user input is allowed into the filter or combined with a prototype pollution attack. ## Recommendation Update to version 1.9.1 or later.

Command Injection An attacker can use the format parameter to inject arbitrary commands in the npm package morgan.