Command Injection in umount

CRITICAL 9.8CVE-2020-7628 · GHSA-6q48-vjq2-mwcj · Published 02/04/2020 · updated 17/06/2026

In short

CVE-2020-7628 is a CRITICAL (CVSS 9.8) vulnerability affecting umount (umount project), umount.
Chance of exploitation in the next 30 days (EPSS): 1.8%, higher than 78.5% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
umount umount_project	`≤ 1.1.6`	No fix yet
umount npm	`≤ 1.1.6`	No fix yet

Description

All versions of umount are vulnerable to Command Injection. The package fails to sanitize input rules and passes it directly to an exec call on the umount function . This may allow attackers to execute arbitrary code in the system if the device value passed to the function is user-controlled.

Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

NVD description

umount through 1.1.6 is vulnerable to Command Injection. The argument device can be controlled by users without any sanitization.

References

nvd.nist.gov/vuln/detail/CVE-2020-7628 · ADVISORY
snyk.io/vuln/SNYK-JS-UMOUNT-564265 · WEB
npmjs.com/advisories/1512 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free