GitHub Advisoryadvisory · npm

GHSA-48ww-j4fc-435p Command injection in nodemailer

CRITICAL Published 2021-05-10 Modified 2021-04-19 Official page ↗
Aliases
CVE-2020-7769
Ecosystem
npm
Packages
nodemailer
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-88
Reviewed
2021-04-19

Affected packages

• npm nodemailer: < 6.4.16 → fixed in 6.4.16

Description

This affects the package nodemailer before 6.4.16. Use of crafted recipient email addresses may result in arbitrary command flag injection in sendmail transport for sending mails.

Related

Alias · CVE (1)

  • CVE-2020-7769 This affects the package nodemailer before 6.4.16. vulnerability

Weakness · CWE (1)

  • CWE-88 Improper Neutralization of Argument Delimiters in a Command weakness

References