Command injection in nodemailer

严重 9.8CVE-2020-7769 · GHSA-48ww-j4fc-435p · Published 12/11/2020 · updated 17/06/2026

要点

CVE-2020-7769 是影响 nodemailer (nodemailer), nodemailer 的严重 (CVSS 9.8)漏洞。
未来 30 天内被利用的概率（EPSS）：2.3%，高于 83.3% 的漏洞。
修复：升级到 6.4.16 或更高版本。

Package	Affected versions	Patched versions
nodemailer nodemailer	`< 6.4.16`	`6.4.16`
nodemailer npm	`< 6.4.16`	`6.4.16`

Description

This affects the package nodemailer before 6.4.16. Use of crafted recipient email addresses may result in arbitrary command flag injection in sendmail transport for sending mails.

NVD description

This affects the package nodemailer before 6.4.16. Use of crafted recipient email addresses may result in arbitrary command flag injection in sendmail transport for sending mails.

References

nvd.nist.gov/vuln/detail/CVE-2020-7769 · ADVISORY
nodemailer/nodemailer commit ba31c64 · WEB
nodemailer/nodemailer · WEB
nodemailer/nodemailer · WEB
snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1039742 · WEB
snyk.io/vuln/SNYK-JS-NODEMAILER-1038834 · WEB
npmjs.com/package/nodemailer · WEB

nodemailer 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

nodemailer

< 6.4.16

6.4.16

nodemailer

npm

< 6.4.16

6.4.16

Description

This affects the package nodemailer before 6.4.16. Use of crafted recipient email addresses may result in arbitrary command flag injection in sendmail transport for sending mails.

NVD description

This affects the package nodemailer before 6.4.16. Use of crafted recipient email addresses may result in arbitrary command flag injection in sendmail transport for sending mails.

nodemailer 的其他漏洞

查看全部 →