OS Command Injection in node-notifier

MEDIUM 5.6CVE-2020-7789 · GHSA-5fw9-fq32-wv5p · Published 11/12/2020 · updated 17/06/2026

In short

CVE-2020-7789 is a MEDIUM (CVSS 5.6) vulnerability affecting node-notifier (node-notifier project), node-notifier.
Chance of exploitation in the next 30 days (EPSS): 1.6%, higher than 75.8% of all vulnerabilities.
Fix: update to 8.0.1 or later.

Package	Affected versions	Patched versions
node-notifier node-notifier_project	`< 8.0.1`	`8.0.1`
node-notifier npm	`< 8.0.1`	`8.0.1`

Description

This affects the package node-notifier before 8.0.1. It allows an attacker to run arbitrary commands on Linux machines due to the options params not being sanitised when being passed an array.

NVD description

This affects the package node-notifier before 9.0.0. It allows an attacker to run arbitrary commands on Linux machines due to the options params not being sanitised when being passed an array.

References

nvd.nist.gov/vuln/detail/CVE-2020-7789 · ADVISORY
mikaelbr/node-notifier commit 5d62799 · WEB
mikaelbr/node-notifier · WEB
snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1050371 · WEB
snyk.io/vuln/SNYK-JS-NODENOTIFIER-1035794 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free