Potential Command Injection in hubot-scripts

KRITISCH 9.8CVE-2013-7378 · GHSA-hwch-749c-rv63 · Published 12/02/2020 · updated 17/06/2026

Kurz gesagt

CVE-2013-7378 ist eine Schwachstelle (KRITISCH (CVSS 9.8)) in hubot scripts (hubot scripts project), hubot-scripts.
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 2.7%, höher als bei 85.9% aller Schwachstellen.
Abhilfe: auf 2.4.4, 2.4.5 oder neuer aktualisieren.

Package	Affected versions	Patched versions
hubot scripts hubot_scripts_project	`< 2.4.4`	`2.4.4`
hubot-scripts npm	`< 2.4.5`	`2.4.5`

Description

Versions 2.4.3 and earlier of hubot-scripts are vulnerable to a command injection vulnerablity in the hubot-scripts/package/src/scripts/email.coffee module.

Mitigating Factors

The email script is not enabled by default, it has to be manually added to hubot's list of loaded scripts.

Recommendation

Update hubot-scripts to version 2.4.4 or later.

NVD description

scripts/email.coffee in the Hubot Scripts module before 2.4.4 for Node.js allows remote attackers to execute arbitrary commands.

References

nvd.nist.gov/vuln/detail/CVE-2013-7378 · ADVISORY
github/hubot-scripts commit feee5ab · WEB
npmjs.com/advisories/13 · WEB
openwall.com/lists/oss-security/2014/05/13/1 · WEB
openwall.com/lists/oss-security/2014/05/15/2 · WEB
web.archive.org/web/20140731222413/https://nodesecurity.io/advisories/Hubot_Potential_command_injection_in_email.coffee · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free