Skip to content
Fencer Vulns
high 7.8

CVE-2019-11354 in the critical feed json

The client in Electronic Arts (EA) Origin 10.5.36 on Windows allows template injection in the title parameter of the Origin2 URI handler.

published 2019-04-19 7 y ago modified 2026-06-17 4 mo ago also EUVD-2019-3033

cvss
7.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
23.1%
EPSS 23.1% chance of exploitation in 30 days, percentile 97%
public exploits
1
Exploit-DB

Summary

The client in Electronic Arts (EA) Origin 10.5.36 on Windows allows template injection in the title parameter of the Origin2 URI handler. This can be used to escape the underlying AngularJS sandbox and achieve remote code execution via an origin2://game/launch URL for QtApplication QDesktopServices communication.

Timeline

  1. Published
  2. First public exploit (EDB-47021)

Exploit prediction

23.13% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • EDB-47021 dotProject 2.1.9 - SQL Injection webapps, 2019-06-24
  • techcrunch.com https://techcrunch.com/2019/04/16/ea-origin-bug-exposed-hackers/ referenced PoC, tagged "exploit" by a source, unverified
  • gizmodo.com https://gizmodo.com/ea-origin-users-update-your-client-now-1834079604 referenced PoC, tagged "exploit" by a source, unverified
  • packetstormsecurity.com http://packetstormsecurity.com/files/153375/dotProject-2.1.9-SQL-Injection.html referenced PoC, tagged "exploit" by a source, unverified
  • packetstormsecurity.com http://packetstormsecurity.com/files/153485/EA-Origin-Template-Injection-Remote-Code-Execution.html referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD 2.0 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P

Classification

Weakness
  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.