CVE-2020-7789

Command Injection

5.6 MediumFix available

This affects the package node-notifier before 9.0.0. It allows an attacker to run arbitrary commands on Linux machines due to the options params not being sanitised when being passed an array.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: Low

Exploit likelihood

1.59%Up 0.8 points since Apr 14, 2021

What each source reports

CVE List Score used 5.6

Command Injection

This affects the package node-notifier before 9.0.0. It allows an attacker to run arbitrary commands on Linux machines due to the options params not being sanitised when being passed an array.

Record: CVE-2020-7789
CVSS 3.1: 5.6 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated: 2026-11-02

EUVDEUVD-2020-1483 5.6

This affects the package node-notifier before 9.0.0. It allows an attacker to run arbitrary commands on Linux machines due to the options params not being sanitised when being passed an array.

Record: EUVD-2020-1483
CVSS 3.1: 5.6 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated: 2026-11-03

GitHub AdvisoriesGHSA-5fw9-fq32-wv5p 5.6

OS Command Injection in node-notifier

This affects the package node-notifier before 8.0.1. It allows an attacker to run arbitrary commands on Linux machines due to the options params not being sanitised when being passed an array.

Record: GHSA-5fw9-fq32-wv5p
CVSS 3.1: 5.6 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Weakness: CWE-78
Updated: 2026-11-02

NVD 5.6

This affects the package node-notifier before 9.0.0. It allows an attacker to run arbitrary commands on Linux machines due to the options params not being sanitised when being passed an array.

Record: CVE-2020-7789
CVSS 3.1: 5.6 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS 2.0: 6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness: CWE-78
Updated: 2026-11-02

OSV 5.6

This affects the package node-notifier before 9.0.0. It allows an attacker to run arbitrary commands on Linux machines due to the options params not being sanitised when being passed an array.

Record: CVE-2020-7789
CVSS 3.1: 5.6 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated: 2026-11-02

OSVGHSA-5fw9-fq32-wv5p 5.6

OS Command Injection in node-notifier

This affects the package node-notifier before 8.0.1. It allows an attacker to run arbitrary commands on Linux machines due to the options params not being sanitised when being passed an array.

Record: GHSA-5fw9-fq32-wv5p
CVSS 3.1: 5.6 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Weakness: CWE-78
Updated: 2026-11-02

OSVRHSA-2021:0781 7.5

Red Hat Security Advisory: Red Hat Ansible Automation Platform 1.2.2 security and bug fix update

Record: RHSA-2021:0781
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVCLSA-2026-1774916714 No score

TuxCare security update for node-notifier (1 CVE)

TuxCare rebuilt node-notifier to address 1 CVE. Fixed in 5.4.5-tuxcare.1.

Record: CLSA-2026-1774916714
Updated: 2026-11-02

OSVCLSA-2026-1787592062 No score

TuxCare security update for node-notifier (1 CVE)

TuxCare rebuilt node-notifier to address 1 CVE. Fixed in 7.0.2-tuxcare.1.

Record: CLSA-2026-1787592062
Updated: 2026-11-02

Affected products

node-notifier project node-notifier

Affected packages

Affected packages
Package	Affected	Fixed
`node-notifier` npm	before 8.0.1	8.0.1
`node-notifier` TuxCare:npm	5.4.5-tuxcare.0 up to 5.4.5-tuxcare.1, plus listed versions 5.4.5	5.4.5-tuxcare.1
`node-notifier` TuxCare:npm	7.0.2-tuxcare.0 up to 7.0.2-tuxcare.1, plus listed versions 7.0.2	7.0.2-tuxcare.1
`automation-hub` Red Hat:ansible_automation_platform:4.2::el7 From an advisory covering 6 CVEs	before 0:4.2.2-1.el7pc	0:4.2.2-1.el7pc
`python-bleach` Red Hat:ansible_automation_platform:4.2::el7 From an advisory covering 6 CVEs	before 0:3.3.0-1.el7pc	0:3.3.0-1.el7pc
`python-bleach-allowlist` Red Hat:ansible_automation_platform:4.2::el7 From an advisory covering 6 CVEs	before 0:1.0.3-1.el7pc	0:1.0.3-1.el7pc
`python-galaxy-importer` Red Hat:ansible_automation_platform:4.2::el7 From an advisory covering 6 CVEs	before 0:0.2.15-1.el7pc	0:0.2.15-1.el7pc
`python-galaxy-ng` Red Hat:ansible_automation_platform:4.2::el7 From an advisory covering 6 CVEs	before 0:4.2.2-1.el7pc	0:4.2.2-1.el7pc
`python-pulp-ansible` Red Hat:ansible_automation_platform:4.2::el7 From an advisory covering 6 CVEs	before 1:0.5.6-1.el7pc	1:0.5.6-1.el7pc
`python3-bleach` Red Hat:ansible_automation_platform:4.2::el7 From an advisory covering 6 CVEs	before 0:3.3.0-1.el7pc	0:3.3.0-1.el7pc

Show 17 moreShow less

Affected packages
Package	Affected	Fixed
`python3-bleach-allowlist` Red Hat:ansible_automation_platform:4.2::el7 From an advisory covering 6 CVEs	before 0:1.0.3-1.el7pc	0:1.0.3-1.el7pc
`python3-django` Red Hat:ansible_automation_platform:4.2::el7 From an advisory covering 6 CVEs	before 0:2.2.18-1.el7pc	0:2.2.18-1.el7pc
`python3-galaxy-importer` Red Hat:ansible_automation_platform:4.2::el7 From an advisory covering 6 CVEs	before 0:0.2.15-1.el7pc	0:0.2.15-1.el7pc
`python3-galaxy-ng` Red Hat:ansible_automation_platform:4.2::el7 From an advisory covering 6 CVEs	before 0:4.2.2-1.el7pc	0:4.2.2-1.el7pc
`python3-pulp-ansible` Red Hat:ansible_automation_platform:4.2::el7 From an advisory covering 6 CVEs	before 1:0.5.6-1.el7pc	1:0.5.6-1.el7pc
`automation-hub` Red Hat:ansible_automation_platform:4.2::el8 From an advisory covering 6 CVEs	before 0:4.2.2-1.el8pc	0:4.2.2-1.el8pc
`python-bleach` Red Hat:ansible_automation_platform:4.2::el8 From an advisory covering 6 CVEs	before 0:3.3.0-1.el8pc	0:3.3.0-1.el8pc
`python-bleach-allowlist` Red Hat:ansible_automation_platform:4.2::el8 From an advisory covering 6 CVEs	before 0:1.0.3-1.el8pc	0:1.0.3-1.el8pc
`python-galaxy-importer` Red Hat:ansible_automation_platform:4.2::el8 From an advisory covering 6 CVEs	before 0:0.2.15-1.el8pc	0:0.2.15-1.el8pc
`python-galaxy-ng` Red Hat:ansible_automation_platform:4.2::el8 From an advisory covering 6 CVEs	before 0:4.2.2-1.el8pc	0:4.2.2-1.el8pc
`python-pulp-ansible` Red Hat:ansible_automation_platform:4.2::el8 From an advisory covering 6 CVEs	before 1:0.5.6-1.el8pc	1:0.5.6-1.el8pc
`python3-bleach` Red Hat:ansible_automation_platform:4.2::el8 From an advisory covering 6 CVEs	before 0:3.3.0-1.el8pc	0:3.3.0-1.el8pc
`python3-bleach-allowlist` Red Hat:ansible_automation_platform:4.2::el8 From an advisory covering 6 CVEs	before 0:1.0.3-1.el8pc	0:1.0.3-1.el8pc
`python3-django` Red Hat:ansible_automation_platform:4.2::el8 From an advisory covering 6 CVEs	before 0:2.2.18-1.el8pc	0:2.2.18-1.el8pc
`python3-galaxy-importer` Red Hat:ansible_automation_platform:4.2::el8 From an advisory covering 6 CVEs	before 0:0.2.15-1.el8pc	0:0.2.15-1.el8pc
`python3-galaxy-ng` Red Hat:ansible_automation_platform:4.2::el8 From an advisory covering 6 CVEs	before 0:4.2.2-1.el8pc	0:4.2.2-1.el8pc
`python3-pulp-ansible` Red Hat:ansible_automation_platform:4.2::el8 From an advisory covering 6 CVEs	before 1:0.5.6-1.el8pc	1:0.5.6-1.el8pc

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases, published	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-7789 is a medium vulnerability (CVSS 5.6) in Node-notifier Project Node-notifier, published December 11, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.59%, the 75th percentile. Fixed in node-notifier 8.0.1.

References

Show 28 moreShow less