GHSA-5fw9-fq32-wv5p

OS Command Injection in node-notifier

En bref

Publiée: 2020-12-21 16:04 UTC
Mise à jour: 2025-01-14 08:56 UTC
CVE: CVE-2020-7789
CVSS_V3: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Description

This affects the package node-notifier before 8.0.1. It allows an attacker to run arbitrary commands on Linux machines due to the options params not being sanitised when being passed an array.

Paquets affectés

Paquet	Versions
npm · node-notifier	introduced 0, fixed 8.0.1

Références

https://nvd.nist.gov/vuln/detail/CVE-2020-7789 ADVISORY
https://github.com/mikaelbr/node-notifier/commit/5d62799dab88505a709cd032653b2320c5813fce WEB
https://github.com/mikaelbr/node-notifier/blob/master/lib/utils.js%23L303 WEB
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1050371 WEB
https://snyk.io/vuln/SNYK-JS-NODENOTIFIER-1035794 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database