Every CVESearch/Get API key

CVE-2013-7381

Potential Command Injection in libnotify

9.8 CriticalFix available

libnotify before 1.0.4 for Node.js allows remote attackers to execute arbitrary commands via unspecified characters in a call to libnotify.notify.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

2.69%Up 1.5 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used9.8

libnotify before 1.0.4 for Node.js allows remote attackers to execute arbitrary commands via unspecified characters in a call to libnotify.notify.

Record
CVE-2013-7381
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-74
Updated
2026-11-02
CVE ListNo score

libnotify before 1.0.4 for Node.js allows remote attackers to execute arbitrary commands via unspecified characters in a call to libnotify.notify.

Record
CVE-2013-7381
Updated
2026-11-02
EUVDEUVD-2020-0598No score

libnotify before 1.0.4 for Node.js allows remote attackers to execute arbitrary commands via unspecified characters in a call to libnotify.notify.

Record
EUVD-2020-0598
Updated
2026-11-03
GitHub AdvisoriesGHSA-6898-wx94-8jq89.8

Potential Command Injection in libnotify

Versions 1.0.3 and earlier of libnotify are affected by a shell command injection vulnerability. This may result in execution of arbitrary shell commands, if user input is passed into libnotify.notify.

Untrusted input passed in the call to libnotify.notify could result in execution of shell commands. Callers may be unaware of this.

Example

var libnotify = require('libnotify')
libnotify.notify('UNTRUSTED INPUT', { title: \"\" }, function () {
    console.log(arguments);
})

Special thanks to Neal Poole for submitting the pull request to fix this issue.

Recommendation

Update to version 1.0.4 or greater

Record
GHSA-6898-wx94-8jq8
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-74
Updated
2026-11-02
OSVAZL-1129919.8

CVE-2013-7381 affecting package libnotify 0.8.3-1

libnotify before 1.0.4 for Node.js allows remote attackers to execute arbitrary commands via unspecified characters in a call to libnotify.notify.

Record
AZL-112991
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-10
OSVGHSA-6898-wx94-8jq89.8

Potential Command Injection in libnotify

Versions 1.0.3 and earlier of libnotify are affected by a shell command injection vulnerability. This may result in execution of arbitrary shell commands, if user input is passed into libnotify.notify.

Untrusted input passed in the call to libnotify.notify could result in execution of shell commands. Callers may be unaware of this.

Example

var libnotify = require('libnotify')
libnotify.notify('UNTRUSTED INPUT', { title: \"\" }, function () {
    console.log(arguments);
})

Special thanks to Neal Poole for submitting the pull request to fix this issue.

Recommendation

Update to version 1.0.4 or greater

Record
GHSA-6898-wx94-8jq8
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-74
Updated
2026-11-02
OSVUBUNTU-CVE-2013-73819.8

libnotify before 1.0.4 for Node.js allows remote attackers to execute arbitrary commands via unspecified characters in a call to libnotify.notify.

Record
UBUNTU-CVE-2013-7381
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
libnotify
npm
through 1.0.3
1.0.4
libnotify
Azure Linux:3
through 0.8.3-1None known
libnotify
npm
before 1.0.4
1.0.4

History

History
RecordedChangedSources
affected, aliases, facts, referencesOSV
affected
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2013-7381 is a critical vulnerability (CVSS 9.8) in Libnotify Project Libnotify, published February 12, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.69%, the 86th percentile. Fixed in libnotify 1.0.4.

References

Show 5 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open