CVE-2013-7381 Potential Command Injection in libnotify
Remote attackers can execute arbitrary commands via unspecified characters in libnotify.notify calls in Node.js.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2013-7381?
CVE-2013-7381 is a critical command injection vulnerability in n/a, published on 12 Feb 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
libnotify before 1.0.4 for Node.js allows remote attackers to execute arbitrary commands via unspecified characters in a call to libnotify.notify.
Weakness: CWE-74
Which versions are affected by CVE-2013-7381?
2 open source packages ship an affected version, including libnotify. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
libnotify npm | All versions | 1.0.4 |
libnotify npm | All versions | 1.0.4 |
Products include Libnotify Project Libnotify.
How do I fix CVE-2013-7381?
Upgrade libnotify to 1.0.4 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2013-7381 being exploited?
There is no known exploitation of CVE-2013-7381 in the wild and no public exploit code.
Sources
Also known as GHSA-6898-wx94-8jq8.