Moole Vulnerability Database

Find real vulnerabilities before they ship

Critical

CVE-2017-16042

Growl adds growl notification support to nodejs. Growl before 1.10.2 does not properly sanitize input before passing it to exec, allowing for arbitrary command execution.

VectorNETWORK

PublishedJun 04, 2018, 19:29

Published Bysupport@hackerone.com

Base Score

Score9.8

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

growl(npm)01.10.0N/A

References

https://github.com/tj/node-growl/issues/60
https://github.com/tj/node-growl/pull/61
https://nodesecurity.io/advisories/146

Weakness Type

CWE-78

CVSS Metrics

Base Score

9.8

Vector String

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Base SeverityCritical

Version

3.0

Attack Vector (AV)

NETWORK