GitHub Advisoryadvisory · npm

GHSA-hwch-749c-rv63 Potential Command Injection in hubot-scripts

CRITICAL Published 2020-08-31 Modified 2021-04-12 Official page ↗
Aliases
CVE-2013-7378
Ecosystem
npm
Packages
hubot-scripts
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-74
Reviewed
2020-08-31

Affected packages

• npm hubot-scripts: < 2.4.5 → fixed in 2.4.5

Description

Versions 2.4.3 and earlier of hubot-scripts are vulnerable to a command injection vulnerablity in the `hubot-scripts/package/src/scripts/email.coffee` module. Mitigating Factors The email script is not enabled by default, it has to be manually added to hubot's list of loaded scripts. Recommendation Update hubot-scripts to version 2.4.4 or later.

Related

Alias · CVE (1)

  • CVE-2013-7378 scripts/email.coffee in the Hubot Scripts module before 2.4.4 for Node.js allows remote attackers to execute arbitrary commands. vulnerability

Weakness · CWE (1)

  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness

References