CVE-2013-7381 – libnotify

Package

Manager: npm
Name: libnotify
Vulnerable Version: >=0 <1.0.4

Severity

Level: Critical

CVSS v3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

EPSS: 0.02011 pctl0.82999

Details

Potential Command Injection in libnotify Versions 1.0.3 and earlier of libnotify are affected by a shell command injection vulnerability. This may result in execution of arbitrary shell commands, if user input is passed into libnotify.notify. Untrusted input passed in the call to libnotify.notify could result in execution of shell commands. Callers may be unaware of this. ### Example ```js var libnotify = require('libnotify') libnotify.notify('UNTRUSTED INPUT', { title: \"\" }, function () { console.log(arguments); }) ``` Special thanks to Neal Poole for submitting the pull request to fix this issue. ## Recommendation Update to version 1.0.4 or greater

Metadata

Created: 2020-08-31T22:50:48Z
Modified: 2023-09-08T20:38:35Z
Source: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/08/GHSA-6898-wx94-8jq8/GHSA-6898-wx94-8jq8.json
CWE IDs: ["CWE-74"]
Alternative ID: GHSA-6898-wx94-8jq8
Finding: F184
Auto approve: 1