p PatchFirst

CVE-2020-7769

CVE-2020-7769 · Command Injection

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This affects the package nodemailer before 6.4.16. Use of crafted recipient email addresses may result in arbitrary command flag injection in sendmail transport for sending mails.

CVSS 8.6 · High · EPSS 2.3% · Fix available

Published
Updated

Stack: system · node

Affected products and versions

  • nodemailer

    Versions
    • ≥ unspecified, < 6.4.16: Affected (custom)

    Update to 6.4.16

  • node-nodemailer Debian:12

    Affected ranges
    • ECOSYSTEM: < 6.4.16-1

    Update to 6.4.16-1

  • node-nodemailer Debian:13

    Affected ranges
    • ECOSYSTEM: < 6.4.16-1

    Update to 6.4.16-1

  • node-nodemailer Debian:14

    Affected ranges
    • ECOSYSTEM: < 6.4.16-1

    Update to 6.4.16-1

  • nodemailer npm

    Affected ranges
    • SEMVER: < 6.4.16

    Update to 6.4.16

  • node-nodemailer Ubuntu:20.04:LTS

    Versions
    • 6.3.0-2
    • 6.3.1-1
    • 6.4.0-1
    • 6.4.1-1
    • 6.4.2-1
    • 6.4.5-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →