Description

This affects the package node-notifier before 9.0.0. It allows an attacker to run arbitrary commands on Linux machines due to the options params not being sanitised when being passed an array.

Remediation

References

https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1050371

https://snyk.io/vuln/SNYK-JS-NODENOTIFIER-1035794

https://github.com/mikaelbr/node-notifier/blob/master/lib/utils.js%23L303

Related Vulnerabilities

CVE-2014-3623 Vulnerability in maven package org.apache.ws.security:wss4j

CVE-2017-7678 Vulnerability in maven package org.apache.spark:spark-core

CVE-2020-36650 Vulnerability in npm package gry

CVE-2022-25350 Vulnerability in npm package puppet-facter

CVE-2021-23337 Vulnerability in npm package lodash.template

Severity

Medium

Classification

CWE-78 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Tags

Third Party Advisory Broken Link