GitHub Advisoryadvisory · npm

GHSA-6898-wx94-8jq8 Potential Command Injection in libnotify

CRITICAL Published 2020-08-31 Modified 2023-09-08 Official page ↗
Aliases
CVE-2013-7381
Ecosystem
npm
Packages
libnotify
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-74
Reviewed
2020-08-31

Affected packages

• npm libnotify: < 1.0.4 → fixed in 1.0.4

Description

Versions 1.0.3 and earlier of libnotify are affected by a shell command injection vulnerability. This may result in execution of arbitrary shell commands, if user input is passed into libnotify.notify. Untrusted input passed in the call to libnotify.notify could result in execution of shell commands. Callers may be unaware of this. Example ```js var libnotify = require('libnotify') libnotify.notify('UNTRUSTED INPUT', { title: \"\" }, function () { console.log(arguments); }) ``` Special thanks to Neal Poole for submitting the pull request to fix this issue. Recommendation Update to version 1.0.4 or greater

Related

Alias · CVE (1)

  • CVE-2013-7381 libnotify before 1.0.4 for Node.js allows remote attackers to execute arbitrary commands via unspecified characters in a call to… vulnerability

Weakness · CWE (1)

  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness

References