CriticalGHSA-48ww-j4fc-435pCVE-2020-7769
Command injection in nodemailer
Published 10 May 2021 · Updated 14 Jan 2025
Affected package
nodemailernpm
- Affected
- <6.4.16
- Fixed in
- 6.4.16
Update to the fixed version for your release line, for example:
npm install nodemailer@6.4.16Details
This affects the package nodemailer before 6.4.16. Use of crafted recipient email addresses may result in arbitrary command flag injection in sendmail transport for sending mails.
Is GHSA-48ww-j4fc-435p in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected nodemailer, and gives you the command that fixes it.
References
- Advisorynvd.nist.gov/vuln/detail/CVE-2020-7769
- Linkgithub.com/nodemailer/nodemailer/commit/ba31c64c910d884579875c52d57ac45acc47aa54
- Linkgithub.com/nodemailer/nodemailer/blob/33b62e2ea6bc9215c99a9bb4bfba94e2fb27ebd0/lib/sendmail-transport/index.js#L75
- Linkgithub.com/nodemailer/nodemailer/blob/33b62e2ea6bc9215c99a9bb4bfba94e2fb27ebd0/lib/sendmail-transport/index.js%23L75
- Linksnyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1039742
- Linksnyk.io/vuln/SNYK-JS-NODEMAILER-1038834
- Linkwww.npmjs.com/package/nodemailer
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.