OS Command Injection in node-notifier · CVE-2020-7789 · GitHub Advisory Database · GitHub

OS Command Injection in node-notifier

Moderate severity GitHub Reviewed Published Dec 21, 2020 to the GitHub Advisory Database • Updated Jan 9, 2023

Package

node-notifier (npm)

Affected versions

< 8.0.1

Patched versions

8.0.1

Description

This affects the package node-notifier before 8.0.1. It allows an attacker to run arbitrary commands on Linux machines due to the options params not being sanitised when being passed an array.

References

Reviewed Dec 17, 2020

Published to the GitHub Advisory Database Dec 21, 2020

Last updated Jan 9, 2023

Severity

Moderate

5.6

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

High

Privileges required

None

User interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L