CVE-2013-7378
Potential Command Injection in hubot-scripts
scripts/email.coffee in the Hubot Scripts module before 2.4.4 for Node.js allows remote attackers to execute arbitrary commands.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
scripts/email.coffee in the Hubot Scripts module before 2.4.4 for Node.js allows remote attackers to execute arbitrary commands.
- Record
CVE-2013-7378- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-74
- Updated
- 2026-11-02
CVE ListNo score
scripts/email.coffee in the Hubot Scripts module before 2.4.4 for Node.js allows remote attackers to execute arbitrary commands.
- Record
CVE-2013-7378- Updated
- 2026-11-02
EUVDEUVD-2020-0627No score
scripts/email.coffee in the Hubot Scripts module before 2.4.4 for Node.js allows remote attackers to execute arbitrary commands.
- Record
EUVD-2020-0627- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-hwch-749c-rv63
Potential Command Injection in hubot-scripts
Versions 2.4.3 and earlier of hubot-scripts are vulnerable to a command injection vulnerablity in the hubot-scripts/package/src/scripts/email.coffee module.
Mitigating Factors
The email script is not enabled by default, it has to be manually added to hubot's list of loaded scripts.
Recommendation
Update hubot-scripts to version 2.4.4 or later.
- Record
GHSA-hwch-749c-rv63- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-74
- Updated
- 2026-11-02
OSVGHSA-hwch-749c-rv63
Potential Command Injection in hubot-scripts
Versions 2.4.3 and earlier of hubot-scripts are vulnerable to a command injection vulnerablity in the hubot-scripts/package/src/scripts/email.coffee module.
Mitigating Factors
The email script is not enabled by default, it has to be manually added to hubot's list of loaded scripts.
Recommendation
Update hubot-scripts to version 2.4.4 or later.
- Record
GHSA-hwch-749c-rv63- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-74
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
hubot-scriptsnpm | through 2.4.3 | 2.4.5 |
hubot-scriptsnpm | before 2.4.5 | 2.4.5 |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-7378 is a critical vulnerability (CVSS 9.8) in Hubot Scripts Project Scripts, published February 12, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.69%, the 86th percentile. Fixed in hubot-scripts 2.4.5.
References
openwall.com/lists/oss-security/2014/05/13/1
github.com/github/hubot-scripts/commit/feee5abdb038a229a98969ae443cdb8a61747782
web.archive.org/web/20140731222413/https://nodesecurity.io/advisories/Hubot_Potential_command_injection_in_email.coffee
nvd.nist.gov/vuln/detail/CVE-2013-7378
npmjs.com/advisories/13