CVE-2020-7789

MediumCVSS 5.6/10Last modified Jun 17, 2026

Description

This affects the package node-notifier before 9.0.0. It allows an attacker to run arbitrary commands on Linux machines due to the options params not being sanitised when being passed an array.

Metrics

CVSS 3.1 5.6/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
n/a	node-notifier	>= unspecified, < 9.0.0

References

https://github.com/mikaelbr/node-notifier/blob/master/lib/utils.js%23L303Broken Link
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1050371Third Party Advisory
https://snyk.io/vuln/SNYK-JS-NODENOTIFIER-1035794Third Party Advisory
https://github.com/mikaelbr/node-notifier/blob/master/lib/utils.js%23L303Broken Link
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1050371Third Party Advisory
https://snyk.io/vuln/SNYK-JS-NODENOTIFIER-1035794Third Party Advisory

Timeline

Published: Dec 11, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-77905.3This affects the package spatie/browsershot from 0.0.0. By specifying a URL in the file:// protocol an attacker is able to include arbitrary CVE-2020-77917.5This affects the package i18n before 2.1.15. Vulnerability arises out of insufficient handling of erroneous language tags in src/i18n/Concre CVE-2020-77927.5This affects all versions of package mout. The deepFillIn function can be used to 'fill missing properties recursively', while the deepMixIn CVE-2020-77937.5The package ua-parser-js before 0.7.23 are vulnerable to Regular Expression Denial of Service (ReDoS) in multiple regexes (see linked commit CVE-2020-77949.8This affects all versions of package buns. The injection point is located in line 678 in index file lib/index.js in the exported function in CVE-2020-77959.8The package get-npm-package-version before 1.0.7 are vulnerable to Command Injection via main function in index.js.CVE-2020-77969.8Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 allows SSRF when WebEx zimlet is installed and zimlet JSP is enabled.CVE-2020-77997.2An issue was discovered in FusionAuth before 1.11.0. An authenticated user, allowed to edit e-mail templates (Home -> Settings -> Email Temp CVE-2020-78008.2The Synergy Systems & Solutions (SSS) HUSKY RTU 6049-E70, with firmware Versions 5.0 and prior, has an Improper Check for Unusual or Excepti CVE-2020-78015.3The Synergy Systems & Solutions (SSS) HUSKY RTU 6049-E70, with firmware Versions 5.0 and prior, has an Exposure of Sensitive Information to CVE-2020-78025.3The Synergy Systems & Solutions (SSS) HUSKY RTU 6049-E70, with firmware Versions 5.0 and prior, has an Incorrect Default Permissions (CWE-27 CVE-2020-78038.8IMGTech Co,Ltd ZInsX.ocx ActiveX Control in Zoneplayer 2.0.1.3, version 2.0.1.4 and prior versions on Windows. File Donwload vulnerability i