CVE-2020-7628
Command Injection in umount
umount through 1.1.6 is vulnerable to Command Injection. The argument device can be controlled by users without any sanitization.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
umount through 1.1.6 is vulnerable to Command Injection. The argument device can be controlled by users without any sanitization.
- Record
CVE-2020-7628- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-78
- Updated
- 2026-11-02
CVE List No score
umount through 1.1.6 is vulnerable to Command Injection. The argument device can be controlled by users without any sanitization.
- Record
CVE-2020-7628- Updated
- 2026-11-02
EUVDEUVD-2020-0466 No score
umount through 1.1.6 is vulnerable to Command Injection. The argument device can be controlled by users without any sanitization.
- Record
EUVD-2020-0466- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6q48-vjq2-mwcj
Command Injection in umount
All versions of umount are vulnerable to Command Injection. The package fails to sanitize input rules and passes it directly to an exec call on the umount function . This may allow attackers to execute arbitrary code in the system if the device value passed to the function is user-controlled.
Recommendation
No fix is currently available. Consider using an alternative package until a fix is made available.
- Record
GHSA-6q48-vjq2-mwcj- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-02
OSVGHSA-6q48-vjq2-mwcj
Command Injection in umount
All versions of umount are vulnerable to Command Injection. The package fails to sanitize input rules and passes it directly to an exec call on the umount function . This may allow attackers to execute arbitrary code in the system if the device value passed to the function is user-controlled.
Recommendation
No fix is currently available. Consider using an alternative package until a fix is made available.
- Record
GHSA-6q48-vjq2-mwcj- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
umountnpm |
through 1.1.6 | None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-7628 is a critical vulnerability (CVSS 9.8) in Umount Project Umount, published April 2, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.79%, the 78th percentile. No source names a fixed version.