Command injection in nodemailer

CRITIQUE 9.8CVE-2020-7769 · GHSA-48ww-j4fc-435p · Published 12/11/2020 · updated 17/06/2026

En bref

CVE-2020-7769 est une vulnérabilité CRITIQUE (CVSS 9.8) touchant nodemailer (nodemailer), nodemailer.
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 2.3%, plus élevée que 83.3% des vulnérabilités.
Correctif : mettre à jour vers 6.4.16 ou plus récent.

Package	Affected versions	Patched versions
nodemailer nodemailer	`< 6.4.16`	`6.4.16`
nodemailer npm	`< 6.4.16`	`6.4.16`

Description

This affects the package nodemailer before 6.4.16. Use of crafted recipient email addresses may result in arbitrary command flag injection in sendmail transport for sending mails.

NVD description

This affects the package nodemailer before 6.4.16. Use of crafted recipient email addresses may result in arbitrary command flag injection in sendmail transport for sending mails.

References

nvd.nist.gov/vuln/detail/CVE-2020-7769 · ADVISORY
nodemailer/nodemailer commit ba31c64 · WEB
nodemailer/nodemailer · WEB
nodemailer/nodemailer · WEB
snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1039742 · WEB
snyk.io/vuln/SNYK-JS-NODEMAILER-1038834 · WEB
npmjs.com/package/nodemailer · WEB

Autres vulnérabilités de nodemailer

Tout voir →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

nodemailer

< 6.4.16

6.4.16

nodemailer

npm

< 6.4.16

6.4.16

Description

This affects the package nodemailer before 6.4.16. Use of crafted recipient email addresses may result in arbitrary command flag injection in sendmail transport for sending mails.

NVD description

This affects the package nodemailer before 6.4.16. Use of crafted recipient email addresses may result in arbitrary command flag injection in sendmail transport for sending mails.

Autres vulnérabilités de nodemailer

Tout voir →