{"id":"CVE-2013-7381","aliases":["AZL-112991","EUVD-2020-0598","GHSA-6898-wx94-8jq8","UBUNTU-CVE-2013-7381"],"status":"published","title":"Potential Command Injection in libnotify","description":"libnotify before 1.0.4 for Node.js allows remote attackers to execute arbitrary commands via unspecified characters in a call to libnotify.notify.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.02685,"percentile":0.86033,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-74"],"published":"2020-02-12T14:25:23Z","modified":"2026-11-10T14:18:01Z","fixes":[{"ecosystem":"npm","package":"libnotify","fixed_in":["1.0.4"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"libnotify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.0.3"},{"fixed":"1.0.4"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"libnotify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.8.3-1"}]}]},{"source":"osv","ecosystem":"npm","package":"libnotify","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.0.4"}]}]}],"products":[{"vendor":"libnotify_project","product":"libnotify"}],"references":[{"url":"https://nodesecurity.io/advisories/libnotify_potential_command_injection_in_libnotify.notify","tags":["x_refsource_MISC","x_transferred","Broken Link"]},{"url":"http://www.openwall.com/lists/oss-security/2014/05/13/1","tags":["x_refsource_MISC","x_transferred","Mailing List","Third Party Advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2014/05/15/2","tags":["x_refsource_MISC","x_transferred","Mailing List","Third Party Advisory","web","report"]},{"url":"https://github.com/mytrile/node-libnotify/commit/dfe7801d73a0dda10663a0ff3d0ec8b4d5f0d448","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-7381","tags":["web","advisory"]},{"url":"https://www.npmjs.com/advisories/20","tags":["web"]},{"url":"https://github.com/advisories/GHSA-6898-wx94-8jq8"},{"url":"https://github.com/mytrile/node-libnotify","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2013-7381","tags":["report"]},{"url":"https://github.com/lloydwatkin/nodesecurity-advisories/blob/master/advisories/libnotify_potential_command_injection_in_libnotify.notify.md","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-7381","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2013-7381","description":"libnotify before 1.0.4 for Node.js allows remote attackers to execute arbitrary commands via unspecified characters in a call to libnotify.notify.","status":"published","published":"2020-02-12T14:25:23Z","modified":"2024-08-06T18:09:16.195Z","updated_at":"2026-11-02T14:34:59.222149Z"}],"euvd":[{"id":"EUVD-2020-0598","description":"libnotify before 1.0.4 for Node.js allows remote attackers to execute arbitrary commands via unspecified characters in a call to libnotify.notify.","status":"published","published":"2020-02-12T14:25:23Z","modified":"2024-08-06T18:09:16Z","updated_at":"2026-11-03T01:56:23.098352Z"}],"ghsa":[{"id":"GHSA-6898-wx94-8jq8","title":"Potential Command Injection in libnotify","description":"Versions 1.0.3 and earlier of libnotify are affected by a shell command injection vulnerability. This may result in execution of arbitrary shell commands, if user input is passed into libnotify.notify.\n\nUntrusted input passed in the call to libnotify.notify could result in execution of shell commands. Callers may be unaware of this.\n\n### Example\n```js\nvar libnotify = require('libnotify')\nlibnotify.notify('UNTRUSTED INPUT', { title: \\\"\\\" }, function () {\n    console.log(arguments);\n})\n```\n\nSpecial thanks to Neal Poole for submitting the pull request to fix this issue.\n\n\n## Recommendation\n\nUpdate to version 1.0.4 or greater","status":"published","published":"2020-08-31T22:50:48Z","modified":"2023-09-08T20:38:38Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:37:03.287418Z"}],"nvd":[{"id":"CVE-2013-7381","description":"libnotify before 1.0.4 for Node.js allows remote attackers to execute arbitrary commands via unspecified characters in a call to libnotify.notify.","status":"published","published":"2020-02-12T15:15:11.633Z","modified":"2026-06-17T00:01:52.05Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:02:52.934105Z"}],"osv":[{"id":"AZL-112991","title":"CVE-2013-7381 affecting package libnotify 0.8.3-1","description":"libnotify before 1.0.4 for Node.js allows remote attackers to execute arbitrary commands via unspecified characters in a call to libnotify.notify.","status":"published","published":"2020-02-12T15:15:11Z","modified":"2026-11-10T14:18:01.808395874Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-10T15:02:19.085067Z"},{"id":"GHSA-6898-wx94-8jq8","title":"Potential Command Injection in libnotify","description":"Versions 1.0.3 and earlier of libnotify are affected by a shell command injection vulnerability. This may result in execution of arbitrary shell commands, if user input is passed into libnotify.notify.\n\nUntrusted input passed in the call to libnotify.notify could result in execution of shell commands. Callers may be unaware of this.\n\n### Example\n```js\nvar libnotify = require('libnotify')\nlibnotify.notify('UNTRUSTED INPUT', { title: \\\"\\\" }, function () {\n    console.log(arguments);\n})\n```\n\nSpecial thanks to Neal Poole for submitting the pull request to fix this issue.\n\n\n## Recommendation\n\nUpdate to version 1.0.4 or greater","status":"published","published":"2020-08-31T22:50:48Z","modified":"2023-11-08T03:57:29.118083Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T15:46:39.266402Z"},{"id":"UBUNTU-CVE-2013-7381","description":"libnotify before 1.0.4 for Node.js allows remote attackers to execute arbitrary commands via unspecified characters in a call to libnotify.notify.","status":"withdrawn","published":"2020-02-12T15:15:00Z","modified":"2025-07-08T14:59:38.529939Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:07.421078Z"}]}}