CVE-2020-7769

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

This affects the package nodemailer before 6.4.16. Use of crafted recipient email addresses may result in arbitrary command flag injection in sendmail transport for sending mails.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-88

Affected software

No affected versions have been published.

Timeline

Published: Nov 12, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-77709.8This affects the package json8 before 1.0.3. The function adds in the target object the property specified in the path, however it does not CVE-2020-77719.8The package asciitable.js before 1.0.3 are vulnerable to Prototype Pollution via the main function.CVE-2020-77729.8This affects the package doc-path before 2.1.2.CVE-2020-77736.1This affects the package markdown-it-highlightjs before 3.3.1. It is possible insert malicious JavaScript as a value of lang in the markdown CVE-2020-77749.8The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution.CVE-2020-77759.8This affects all versions of package freediskspace. The vulnerability arises out of improper neutralization of arguments in line 71 of freed CVE-2020-77766.4This affects the package phpoffice/phpspreadsheet from 0.0.0. The library is vulnerable to XSS when creating an html output from an excel fi CVE-2020-77777.2This affects all versions of package jsen. If an attacker can control the schema file, it could run arbitrary JavaScript code on the victim CVE-2020-77787.3This affects the package systeminformation before 4.30.2. The attacker can overwrite the properties and functions of an object, which can le CVE-2020-77797.5All versions of package djvalidator are vulnerable to Regular Expression Denial of Service (ReDoS) by sending crafted invalid emails - for e CVE-2020-77808.8This affects the package com.softwaremill.akka-http-session:core_2.13 before 0.5.11; the package com.softwaremill.akka-http-session:core_2.1 CVE-2020-77819.8This affects the package connection-tester before 0.2.1. The injection point is located in line 15 in index.js. The following PoC demonstrat