critical9.8
CVE-2013-7378
Potential Command Injection in hubot-scripts
Impact
Versions 2.4.3 and earlier of hubot-scripts are vulnerable to a command injection vulnerablity in the `hubot-scripts/package/src/scripts/email.coffee` module. ### Mitigating Factors The email script is not enabled by default, it has to be manually added to hubot's list of loaded scripts. ## Recommendation Update hubot-scripts to version 2.4.4 or later.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | hubot-scripts | <= 2.4.3 | 2.4.5 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Hubot Scripts Project | Hubot Scripts | before 2.4.4 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- http://www.openwall.com/lists/oss-security/2014/05/13/1
- http://www.openwall.com/lists/oss-security/2014/05/15/2
- https://github.com/github/hubot-scripts/commit/feee5abdb038a229a98969ae443cdb8a61747782
- https://web.archive.org/web/20140731222413/https://nodesecurity.io/advisories/Hubot_Potential_command_injection_in_email.coffee
- https://github.com/advisories/GHSA-hwch-749c-rv63
- https://nvd.nist.gov/vuln/detail/CVE-2013-7378
- https://www.npmjs.com/advisories/13