CVE-2020-7614
Command Injection in npm-programmatic
npm-programmatic through 0.0.12 is vulnerable to Command Injection.The packages and option properties are concatenated together without any validation and are used by the 'exec' function directly.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
npm-programmatic through 0.0.12 is vulnerable to Command Injection.The packages and option properties are concatenated together without any validation and are used by the 'exec' function directly.
- Record
CVE-2020-7614- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-20, CWE-78
- Updated
- 2026-11-02
CVE List No score
npm-programmatic through 0.0.12 is vulnerable to Command Injection.The packages and option properties are concatenated together without any validation and are used by the 'exec' function directly.
- Record
CVE-2020-7614- Updated
- 2026-11-02
EUVDEUVD-2020-0362 No score
npm-programmatic through 0.0.12 is vulnerable to Command Injection.The packages and option properties are concatenated together without any validation and are used by the 'exec' function directly.
- Record
EUVD-2020-0362- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-426h-24vj-qwxf
Command Injection in npm-programmatic
All versions of npm-programmatic are vulnerable to Command Injection. The package fails to sanitize input rules and passes it directly to an exec call on the install, uninstall and list functions . This may allow attackers to execute arbitrary code in the system if the package name passed to the function is user-controlled.
Recommendation
No fix is currently available. Consider using an alternative package until a fix is made available.
- Record
GHSA-426h-24vj-qwxf- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-20, CWE-78
- Updated
- 2026-11-02
OSVGHSA-426h-24vj-qwxf
Command Injection in npm-programmatic
All versions of npm-programmatic are vulnerable to Command Injection. The package fails to sanitize input rules and passes it directly to an exec call on the install, uninstall and list functions . This may allow attackers to execute arbitrary code in the system if the package name passed to the function is user-controlled.
Recommendation
No fix is currently available. Consider using an alternative package until a fix is made available.
- Record
GHSA-426h-24vj-qwxf- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-20, CWE-78
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
npm-programmaticnpm |
through 0.0.12 | None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-7614 is a critical vulnerability (CVSS 9.8) in Npm-programmatic Project Npm-programmatic, published April 7, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.60%, the 89th percentile. No source names a fixed version.