CVE-2020-7789 Command Injection
Attackers can execute arbitrary commands on Linux systems via unsanitized parameters in the node-notifier library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-7789?
CVE-2020-7789 is a medium-severity command injection vulnerability in node-notifier, published on 11 Dec 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
This affects the package node-notifier before 9.0.0. It allows an attacker to run arbitrary commands on Linux machines due to the options params not being sanitised when being passed an array.
Weakness: CWE-78
Which versions are affected by CVE-2020-7789?
2 open source packages ship an affected version, including node-notifier. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
node-notifier npm | All versions | 8.0.1 |
node-notifier npm | All versions | 8.0.1 |
Products include Node-Notifier Project Node-Notifier.
How do I fix CVE-2020-7789?
Upgrade node-notifier to 8.0.1 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2020-7789 being exploited?
There is no known exploitation of CVE-2020-7789 in the wild and no public exploit code.
Sources
Also known as CLSA-2026-1774916714, CLSA-2026-1787592062, GHSA-5fw9-fq32-wv5p.