CVE-2017-16042

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Growl adds growl notification support to nodejs. Growl before 1.10.2 does not properly sanitize input before passing it to exec, allowing for arbitrary command execution.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94CWE-78

Affected software

No affected versions have been published.

Timeline

Published
Jun 4, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2017

CVE-2017-160436.1Shout is an IRC client. Because the `/topic` command in messages is unescaped, attackers have the ability to inject HTML scripts that will rCVE-2017-160447.5`d3.js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.CVE-2017-160457.5`jquery.js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.CVE-2017-160467.5`mariadb` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.CVE-2017-160477.5mysqljs was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.CVE-2017-160487.5`node-sqlite` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.CVE-2017-160497.5`nodesqlite` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.CVE-2017-160507.5`sqlite.js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.CVE-2017-160517.5`sqliter` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.CVE-2017-160527.5`node-fabric` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.CVE-2017-160537.5`fabric-js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.CVE-2017-160547.5`nodefabric` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
CVE-2017-16042: Critical severity, CVSS 9.8 | Vulnix