Most recent entries from all

EUVD-2026-109210

fkie_cve-2013-7381

libnotify before 1.0.4 for Node.js allows remote attackers to execute arbitrary commands via unspecified characters in a call to libnotify.notify.

GHSA-6898-wx94-8jq8 — Potential Command Injection in libnotify

Affected: npm: libnotify

Versions 1.0.3 and earlier of libnotify are affected by a shell command injection vulnerability. This may result in execution of arbitrary shell commands, if user input is passed into libnotify.notify.

Untrusted input passed in the call to libnotify.notify could result in execution of shell commands. Callers may be unaware of this.

### Example ```js var libnotify = require('libnotify') libnotify.notify('UNTRUSTED INPUT', { title: \"\" }, function () { console.log(arguments); }) ```

Special thanks to Neal Poole for submitting the pull request to fix this issue.

## Recommendation

Update to version 1.0.4 or greater

gsd-2013-7381

msrc_CVE-2013-7381 — libnotify before 1.0.4 for Node.js allows remote attackers to execute arbitrary commands via unspecified characters in…

msrc_CVE-2013-7381

Withdrawn: UBUNTU-CVE-2013-7381

Withdrawn by the publisher.

Affected: Ubuntu:Pro:14.04:LTS: nodejs, Ubuntu:Pro:16.04:LTS: nodejs, Ubuntu:Pro:18.04:LTS: nodejs

libnotify before 1.0.4 for Node.js allows remote attackers to execute arbitrary commands via unspecified characters in a call to libnotify.notify.