Packages / node-notifier / Security

ModerateVulnerabilityGHSA-5fw9-fq32-wv5pCVE-2020-7789Published 21 Dec 2020

OS Command Injection in node-notifier

Affected releases · node-notifier

  • 8.x8.0.0Fixed in 8.0.1
  • 7.x and older0.0.1 – 7.0.2No fix, no longer updated

On 8.x, the newest line:

npm install node-notifier@8.0.1
11.x

  1. Not affected

    11.0.0

    1 release, latest

8.x

  1. Affected

    8.0.0

    1 release

  2. Fixed

    8.0.1 – 8.0.2

    2 releases

7.x

  1. Affected

    7.0.0 – 7.0.2

    3 releases

6.x

  1. Affected

    6.0.0

    1 release

5.x

  1. Affected

    5.0.0 – 5.4.5

    13 releases

4.x

  1. Affected

    4.0.0 – 4.6.1

    17 releases

3.x

  1. Affected

    3.0.0 – 3.4.1

    14 releases

2.x

  1. Affected

    2.0.1 – 2.0.6

    6 releases

1.x

  1. Affected

    1.1.0 – 1.2.1

    4 releases

0.x

  1. Affected

    0.0.1 – 0.5.0

    3 releases

69 stable releases of node-notifier, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for node-notifier. It is read in your browser and sent nowhere.

What happens

This affects the package node-notifier before 8.0.1. It allows an attacker to run arbitrary commands on Linux machines due to the options params not being sanitised when being passed an array.