Executive brief
node-notifier is a Node.js library that sends system notifications on Mac, Windows, and Linux. A command injection vulnerability allows an attacker to execute arbitrary operating system commands on Linux machines by passing unsanitized array parameters to the library. An exploited application could have its system privileges compromised or used to launch further attacks.
Technical details
This is an OS command injection vulnerability (CWE-78) in the node-notifier library affecting versions before 8.0.1 (and 9.0.1 for the 9.x branch). The vulnerability exists because the library does not properly sanitize the options parameters when they are passed as arrays on Linux systems, allowing attackers to inject arbitrary shell commands. The attack requires the vulnerable code path to be reachable via application input, but does not require authentication or user interaction. A successful exploit allows an attacker to execute arbitrary commands with the privileges of the Node.js process. The fix is available in version 8.0.1 and later; version 5.4.5 and 9.0.1 also contain patches.
Affected products
- mikaelbr node-notifier <8.0.1
Timeline
- 2020-11-04: disclosed: Vulnerability disclosed by Alessio Della Libera (d3lla)
- 2020-12-21: patched: Version 8.0.1 released with fix