Executive brief
libnotify is a Node.js library that sends desktop notifications to the system. The library fails to safely handle user input when constructing shell commands, allowing attackers to inject and execute arbitrary commands. This could enable remote code execution if untrusted input is passed to the notify function.
Technical details
This vulnerability is a shell command injection flaw (CWE-74) in the libnotify Node.js library affecting versions 1.0.3 and earlier. The vulnerable code uses child_process.exec() to invoke system notification commands without properly sanitizing user-controlled input passed to the notify function. An attacker who can control the message or title parameters can break out of the intended command structure and inject arbitrary shell commands. The fix, released in version 1.0.4, replaces the unsafe exec() call with execFile(), which does not interpret shell metacharacters. No special authentication or user interaction is required—any caller of the notify function with untrusted input is at risk.
Affected products
- npm libnotify 1.0.3 and earlier
Timeline
- 2020-08-31: disclosed
- 2020-08-31: patched: Fix available in version 1.0.4