~ / search / GHSA-48ww-j4fc-435p

GHSA-48ww-j4fc-435p

Command injection in nodemailer

Source: GitHub Advisory Database (reviewed) Critical CVE-2020-7769

Packages

EcosystemPackageAffectedFixed in
npm nodemailer < 6.4.16 6.4.16

Details

As written in the advisory (Markdown source, shown as plain text).

This affects the package nodemailer before 6.4.16. Use of crafted recipient email addresses may result in arbitrary command flag injection in sendmail transport for sending mails.

References

External links from the advisory. They lead to third-party sites.