Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTY4OTgtd3g5NC04anE4

Potential Command Injection in libnotify

Versions 1.0.3 and earlier of libnotify are affected by a shell command injection vulnerability. This may result in execution of arbitrary shell commands, if user input is passed into libnotify.notify.

Untrusted input passed in the call to libnotify.notify could result in execution of shell commands. Callers may be unaware of this.

Example

var libnotify = require('libnotify')
libnotify.notify('UNTRUSTED INPUT', { title: \"\" }, function () {
    console.log(arguments);
})

Special thanks to Neal Poole for submitting the pull request to fix this issue.

Recommendation

Update to version 1.0.4 or greater

Permalink: https://github.com/advisories/GHSA-6898-wx94-8jq8
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTY4OTgtd3g5NC04anE4
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: over 4 years ago
Updated: over 1 year ago

CVSS Score: 9.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Percentage: 0.00256
EPSS Percentile: 0.64523

Identifiers: GHSA-6898-wx94-8jq8, CVE-2013-7381
References:

• https://nvd.nist.gov/vuln/detail/CVE-2013-7381
• https://github.com/mytrile/node-libnotify/commit/dfe7801d73a0dda10663a0ff3d0ec8b4d5f0d448
• https://www.npmjs.com/advisories/20
• http://www.openwall.com/lists/oss-security/2014/05/13/1
• http://www.openwall.com/lists/oss-security/2014/05/15/2
• https://github.com/advisories/GHSA-6898-wx94-8jq8

Repository: https://github.com/mytrile/node-libnotify
Blast Radius: 12.8

Affected Packages