OS Command Injection in node-notifier
This affects the package node-notifier before 8.0.1. It allows an attacker to run arbitrary commands on Linux machines due to the options params not being sanitised when being passed an array.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2020-7789US | medium5.6 | — | ||
This affects the package node-notifier before 9.0.0. It allows an attacker to run arbitrary commands on Linux machines due to the options params not being sanitised when being pass… | ||||
02
references
External citations — patches, advisories, analysis.
- https://github.com/mikaelbr/node-notifier/blob/master/lib/utils.js%23L303WEB
- https://github.com/mikaelbr/node-notifier/commit/5d62799dab88505a709cd032653b2320c5813fceWEB
- https://nvd.nist.gov/vuln/detail/CVE-2020-7789ADVISORY
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1050371WEB
- https://snyk.io/vuln/SNYK-JS-NODENOTIFIER-1035794WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan