CVE-2013-7381

描述

Versions 1.0.3 and earlier of libnotify are affected by a shell command injection vulnerability. This may result in execution of arbitrary shell commands, if user input is passed into libnotify.notify. Untrusted input passed in the call to libnotify.notify could result in execution of shell commands. Callers may be unaware of this. ### Example ```js var libnotify = require('libnotify') libnotify.notify('UNTRUSTED INPUT', { title: \"\" }, function () { console.log(arguments); }) ``` Special thanks to Neal Poole for submitting the pull request to fix this issue. ## Recommendation Update to version 1.0.4 or greater

如何修補 CVE-2013-7381

要修補 CVE-2013-7381,請將受影響套件升級到下列已修補版本。

• —升級至 1.0.4 或更新版本

CVE-2013-7381 正在被利用嗎?

低 — EPSS 為 2.0%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• from 0, < 1.0.4

CVSS 分數

參考連結(6)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2013-7381
• PATCHgithub.com/mytrile/node-libnotify
• WEBgithub.com/mytrile/node-libnotify/commit/dfe7801d73a0dda10663a0ff3d0ec8b4d5f0d448
• WEBwww.npmjs.com/advisories/20
• WEB