CVE-2020-7769

Command Injection

High · published November 12, 2020

CVSS v3.1
8.6
EPSS
2%
Percentile
83.2
In the wild
Unconfirmed
What it is

This affects the package nodemailer before 6.4.16. Use of crafted recipient email addresses may result in arbitrary command flag injection in sendmail transport for sending mails.

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H/E:P/RL:U/RC:C
CVSS v4.0
Not supplied
EPSS
0.02303 · 83.2th percentile
Published
2020-11-12T08:30Z
EPSS history
Timeline
  • 12 NOV 08:30Z
    Command Injection
    cvelistv5