Executive brief
Growl is a Node.js library used to display system notifications. Versions before 1.10.0 fail to sanitize user input before passing it to shell commands, allowing an attacker to execute arbitrary commands with the privileges of the application using the library.
Technical details
The vulnerability is a command injection (CWE-78, CWE-94) in Growl's notification handling. The library uses the unsafe exec() function to spawn shell commands for displaying notifications without sanitizing user-supplied input. An attacker can inject arbitrary shell commands through notification messages (e.g., using backticks or shell metacharacters). No authentication or special preconditions are required—an attacker who can control input passed to the growl() function can achieve arbitrary code execution. The vulnerability was fixed in version 1.10.0 through the use of proper input sanitization or by replacing exec() with safer alternatives like spawn().
Affected products
- Growl growl before 1.10.0
Timeline
- 2016-07-21: disclosed: Issue reported on GitHub
- 2017: patched: Fixed in version 1.10.0
- 2018-06-08: advisory: GHSA-qh2h-chj9-jffq published