GitHub Advisoryadvisory · npm

GHSA-5fw9-fq32-wv5p OS Command Injection in node-notifier

MEDIUM Published 2020-12-21 Modified 2020-12-21 Official page ↗
Aliases
CVE-2020-7789
Ecosystem
npm
Packages
node-notifier
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-78
Reviewed
2020-12-17

Affected packages

• npm node-notifier: < 8.0.1 → fixed in 8.0.1

Description

This affects the package node-notifier before 8.0.1. It allows an attacker to run arbitrary commands on Linux machines due to the options params not being sanitised when being passed an array.

Related

Alias · CVE (1)

  • CVE-2020-7789 This affects the package node-notifier before 9.0.0. vulnerability

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References