CVE-2020-7789: OS Command Injection

December 11, 2020 (updated December 17, 2020)

node-notifier allows an attacker to run arbitrary commands on Linux machines due to the options parameters not being sanitised when being passed an array.

References

nvd.nist.gov/vuln/detail/CVE-2020-7789

Code Behaviors & Features

Detect and mitigate CVE-2020-7789 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →