CVE-2020-7769

2020-11-1209:15:11

Google

osv.dev

7.3 High

AI Score

Confidence

Low

0.025 Low

EPSS

Percentile

90.3%

JSON

This affects the package nodemailer before 6.4.16. Use of crafted recipient email addresses may result in arbitrary command flag injection in sendmail transport for sending mails.

CPENameOperatorVersion
nodemailereq2.1.0-beta.0
nodemailereq6.4.3
nodemailereq0.1.15
nodemailereq0.3.19
nodemailereq0.1.2
nodemailereq2.6.3
nodemailereq5.0.0
nodemailereq6.3.1
nodemailereq4.0.1
nodemailereq2.2.0-rc.7

Name	Operator	Version
nodemailer	eq	2.1.0-beta.0
nodemailer	eq	6.4.3
nodemailer	eq	0.1.15
nodemailer	eq	0.3.19
nodemailer	eq	0.1.2
nodemailer	eq	2.6.3
nodemailer	eq	5.0.0
nodemailer	eq	6.3.1
nodemailer	eq	4.0.1
nodemailer	eq	2.2.0-rc.7