GitHub Advisoryadvisory · npm

GHSA-wfrj-qqc2-83cm Remote command injection when using sendmail email transport

MEDIUM Published 2021-09-20 Modified 2021-09-17 Official page ↗
Ecosystem
npm
Packages
ghost
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
Weaknesses
CWE-88
Reviewed
2021-09-17

Affected packages

• npm ghost: < 4.15.0 → fixed in 4.15.0

Description

Impact Sites using the `sendmail` transport as part of their `mail` config are vulnerable to remote command injection due to a vulnerability in the `nodemailer` dependency. Ghost defaults to the `direct` transport so this is only exploitable if the `sendmail` transport is explicitly used. Patches Fixed in 4.15.0, all sites should upgrade as soon as possible. Workarounds • Use an alternative email transport as described in the docs. For more information If you have any questions or comments about this advisory: • email us at [email protected]

Related

Weakness · CWE (1)

  • CWE-88 Improper Neutralization of Argument Delimiters in a Command weakness

References