CVE-2013-7381

Description

Versions 1.0.3 and earlier of libnotify are affected by a shell command injection vulnerability. This may result in execution of arbitrary shell commands, if user input is passed into libnotify.notify. Untrusted input passed in the call to libnotify.notify could result in execution of shell commands. Callers may be unaware of this. ### Example ```js var libnotify = require('libnotify') libnotify.notify('UNTRUSTED INPUT', { title: \"\" }, function () { console.log(arguments); }) ``` Special thanks to Neal Poole for submitting the pull request to fix this issue. ## Recommendation Update to version 1.0.4 or greater

How to fix CVE-2013-7381

To remediate CVE-2013-7381, upgrade the affected package to a fixed version below.

• —upgrade to 1.0.4 or later

Is CVE-2013-7381 being exploited?

Low — EPSS is 2.0%, meaning exploitation activity has not been observed at scale.

Affected packages (1)

• from 0, < 1.0.4

CVSS scores

References (6)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2013-7381
• PATCHgithub.com/mytrile/node-libnotify
• WEBgithub.com/mytrile/node-libnotify/commit/dfe7801d73a0dda10663a0ff3d0ec8b4d5f0d448
• WEBwww.npmjs.com/advisories/20
• WEB