critical9.8
CVE-2020-7769
Command injection in nodemailer
Impact
This affects the package nodemailer before 6.4.16. Use of crafted recipient email addresses may result in arbitrary command flag injection in sendmail transport for sending mails.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | nodemailer | < 6.4.16 | 6.4.16 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Nodemailer | Nodemailer | before 6.4.16 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/nodemailer/nodemailer/blob/33b62e2ea6bc9215c99a9bb4bfba94e2fb27ebd0/lib/sendmail-transport/index.js%23L75
- https://github.com/nodemailer/nodemailer/commit/ba31c64c910d884579875c52d57ac45acc47aa54
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1039742
- https://snyk.io/vuln/SNYK-JS-NODEMAILER-1038834
- https://github.com/advisories/GHSA-48ww-j4fc-435p
- https://nvd.nist.gov/vuln/detail/CVE-2020-7769
- https://github.com/nodemailer/nodemailer/blob/33b62e2ea6bc9215c99a9bb4bfba94e2fb27ebd0/lib/sendmail-transport/index.js#L75
- https://www.npmjs.com/package/nodemailer