Vulnerability · Published Nov 12, 2020 · Assigned by snyk
CVE-2020-7769Command Injection
High 8.6
In plain English
A high-severity security flaw in nodemailer. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.3% (higher than 83% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)8.6High
Exploit odds (30 days)2.3%top 16.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
This affects the package nodemailer before 6.4.16. Use of crafted recipient email addresses may result in arbitrary command flag injection in sendmail transport for sending mails.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | node-nodemailer | 6.4.16-1 | DEBIAN-CVE-2020-7769 |
| Debian:13 | node-nodemailer | 6.4.16-1 | DEBIAN-CVE-2020-7769 |
| Debian:14 | node-nodemailer | 6.4.16-1 | DEBIAN-CVE-2020-7769 |
| npm | nodemailer | 6.4.16 | GHSA-48ww-j4fc-435p |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | nodemailer | unspecified – before 6.4.16 |
References
- https://snyk.io/vuln/SNYK-JS-NODEMAILER-1038834 x_refsource_MISC
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1039742 x_refsource_MISC
- https://github.com/nodemailer/nodemailer/blob/33b62e2ea6bc9215c99a9bb4bfba94e2fb27ebd0/lib/sendmail-transport/index.js%23L75 x_refsource_MISC
- https://github.com/nodemailer/nodemailer/commit/ba31c64c910d884579875c52d57ac45acc47aa54 x_refsource_MISC