CVE-2017-16042
Growl before 1.10.0 vulnerable to Command Injection
Growl adds growl notification support to nodejs. Growl before 1.10.2 does not properly sanitize input before passing it to exec, allowing for arbitrary command execution.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Growl adds growl notification support to nodejs. Growl before 1.10.2 does not properly sanitize input before passing it to exec, allowing for arbitrary command execution.
- Record
CVE-2017-16042- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-94, CWE-78
- Updated
- 2026-11-02
CVE List No score
Growl adds growl notification support to nodejs. Growl before 1.10.2 does not properly sanitize input before passing it to exec, allowing for arbitrary command execution.
- Record
CVE-2017-16042- Weakness
- CWE-94
- Updated
- 2026-11-02
EUVDEUVD-2018-0199 No score
Growl adds growl notification support to nodejs. Growl before 1.10.2 does not properly sanitize input before passing it to exec, allowing for arbitrary command execution.
- Record
EUVD-2018-0199- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qh2h-chj9-jffq
Growl before 1.10.0 vulnerable to Command Injection
Affected versions of growl do not properly sanitize input prior to passing it into a shell command, allowing for arbitrary command execution.
Recommendation
Update to version 1.10.0 or later.
- Record
GHSA-qh2h-chj9-jffq- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-78, CWE-94
- Updated
- 2026-11-02
OSVAZL-44547
CVE-2017-16042 affecting package js-jquery 3.5.0-4
Growl adds growl notification support to nodejs. Growl before 1.10.2 does not properly sanitize input before passing it to exec, allowing for arbitrary command execution.
- Record
AZL-44547- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-05
OSV
Growl adds growl notification support to nodejs. Growl before 1.10.2 does not properly sanitize input before passing it to exec, allowing for arbitrary command execution.
- Record
CVE-2017-16042- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSVDEBIAN-CVE-2017-16042
Growl adds growl notification support to nodejs. Growl before 1.10.2 does not properly sanitize input before passing it to exec, allowing for arbitrary command execution.
- Record
DEBIAN-CVE-2017-16042- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-qh2h-chj9-jffq
Growl before 1.10.0 vulnerable to Command Injection
Affected versions of growl do not properly sanitize input prior to passing it into a shell command, allowing for arbitrary command execution.
Recommendation
Update to version 1.10.0 or later.
- Record
GHSA-qh2h-chj9-jffq- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-78, CWE-94
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-16042
Growl adds growl notification support to nodejs. Growl before 1.10.2 does not properly sanitize input before passing it to exec, allowing for arbitrary command execution.
- Record
UBUNTU-CVE-2017-16042- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVCLSA-2026-1773620196 No score
TuxCare security update for growl (1 CVE)
TuxCare rebuilt growl to address 1 CVE. Fixed in 1.7.0-tuxcare.2.
- Record
CLSA-2026-1773620196- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
growlnpm |
before 1.10.0 | 1.10.0 |
js-jqueryAzure Linux:3 |
through 3.5.0-4 | None known |
growlTuxCare:npm |
1.7.0-tuxcare.0 up to 1.7.0-tuxcare.2, plus listed versions 1.7.01.7.0-tuxcare.1 |
1.7.0-tuxcare.2 |
node-growlDebian:12 |
before 1.10.5-1 | 1.10.5-1 |
node-growlDebian:13 |
before 1.10.5-1 | 1.10.5-1 |
node-growlDebian:14 |
before 1.10.5-1 | 1.10.5-1 |
node-growlUbuntu:16.04:LTS |
All versions, plus listed versions 1.7.0-1 |
None known |
node-growlUbuntu:18.04:LTS |
All versions, plus listed versions 1.7.0-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-16042 is a critical vulnerability (CVSS 9.8) in Growl Project Growl, published June 4, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.58%, the 91st percentile. Fixed in growl 1.10.0.