CVE-2020-7769 Command Injection
Attackers can inject arbitrary command flags via crafted email addresses in the sendmail transport, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-7769?
CVE-2020-7769 is a high-severity command injection vulnerability in nodemailer, published on 12 Nov 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
This affects the package nodemailer before 6.4.16. Use of crafted recipient email addresses may result in arbitrary command flag injection in sendmail transport for sending mails.
Weakness: CWE-88
Which versions are affected by CVE-2020-7769?
2 open source packages ship an affected version, including nodemailer. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
nodemailer npm | All versions | 6.4.16 |
nodemailer npm | All versions | 6.4.16 |
Products include Nodemailer Nodemailer.
How do I fix CVE-2020-7769?
Upgrade nodemailer to 6.4.16 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2020-7769 being exploited?
There is no known exploitation of CVE-2020-7769 in the wild and no public exploit code.
Other vulnerabilities in nodemailer
Sources
Also known as CLSA-2026-1784596339, DEBIAN-CVE-2020-7769, GHSA-48ww-j4fc-435p, UBUNTU-CVE-2020-7769.