GHSA-5fw9-fq32-wv5p

    Dashboard / Vulnerabilities / GHSA-5fw9-fq32-wv5p

    GHSA-5fw9-fq32-wv5p

    Published: 21 Dec 2020Last Modified: 14 Jan 2025
    Aliases:
    CVE-2020-7789

    Summary: OS Command Injection in node-notifier

    Details: This affects the package node-notifier before 8.0.1. It allows an attacker to run arbitrary commands on Linux machines due to the options params not being sanitised when being passed an array.

    References: https://nvd.nist.gov/vuln/detail/CVE-2020-7789, https://github.com/mikaelbr/node-notifier/commit/5d62799dab88505a709cd032653b2320c5813fce, https://github.com/mikaelbr/node-notifier/blob/master/lib/utils.js%23L303, https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1050371, https://snyk.io/vuln/SNYK-JS-NODENOTIFIER-1035794

    Affected packages

    Package

    Name: node-notifier

    Purl: pkg:npm/node-notifier

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -8.0.1

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-5fw9-fq32-wv5p | CVE-DB