Moole Vulnerability Database

Find real vulnerabilities before they ship

Medium

CVE-2020-7789

This affects the package node-notifier before 9.0.0. It allows an attacker to run arbitrary commands on Linux machines due to the options params not being sanitised when being passed an array.

VectorNETWORK

PublishedDec 11, 2020, 10:15

Published Byreport@snyk.io

Base Score

Score5.6

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

node-notifier(npm)08.0.1N/A

References

https://github.com/mikaelbr/node-notifier/blob/master/lib/utils.js%23L303
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1050371
https://snyk.io/vuln/SNYK-JS-NODENOTIFIER-1035794

Weakness Type

CWE-78

CVSS Metrics

Base Score

5.6

Vector String

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Base SeverityMedium

Version

3.1

Attack Vector (AV)

NETWORK