Lucene search
Veracode Vulnerability DatabaseVERACODE:27882HistoryNov 13, 2020 - 4:43 a.m.
Command Injection
2020-11-1304:43:13
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
11
0.025 Low
EPSS
Percentile
90.3%
nodemailer is vulnerable to command injection. An attacker can inject malicious command flag via recipient email addresses in sendmail transport due to lack of validation for invalid email addresses.
| CPE | Name | Operator | Version |
|---|---|---|---|
| nodemailer | le | 6.4.15 | |
| nodemailer | le | 6.3.1 |
References
github.com/nodemailer/nodemailer/blob/33b62e2ea6bc9215c99a9bb4bfba94e2fb27ebd0/lib/sendmail-transport/index.js%23L75
github.com/nodemailer/nodemailer/blob/v6.4.15/lib/sendmail-transport/index.js#L75
github.com/nodemailer/nodemailer/commit/ba31c64c910d884579875c52d57ac45acc47aa54
www.npmjs.com/advisories/1708
Related
debiancve
debiancve
CVE-2020-7769
2020-11-12 09:15:11
nodejs
nodejs
Command Injection
2021-05-10 19:18:06
osv
osv
Command injection in nodemailer
2021-05-10 19:16:52
CVE-2020-7769
2020-11-12 09:15:11
ibm
ibm
ubuntucve
ubuntucve
CVE-2020-7769
2020-11-12 00:00:00
cvelist
cvelist
CVE-2020-7769 Command Injection
2020-11-12 00:00:00
cve
cve
CVE-2020-7769
2020-11-12 09:15:11
prion
prion
Command injection
2020-11-12 09:15:00
nvd
nvd
CVE-2020-7769
2020-11-12 09:15:11
github
github
Command injection in nodemailer
2021-05-10 19:16:52