From 578b85dbf2a1aac95cdcee82c5f01f6f931b8d90 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Fri, 8 Sep 2023 20:40:03 +0000 Subject: [PATCH] Publish GHSA-6898-wx94-8jq8 --- .../2020/08/GHSA-6898-wx94-8jq8/GHSA-6898-wx94-8jq8.json | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/advisories/github-reviewed/2020/08/GHSA-6898-wx94-8jq8/GHSA-6898-wx94-8jq8.json b/advisories/github-reviewed/2020/08/GHSA-6898-wx94-8jq8/GHSA-6898-wx94-8jq8.json index e058b08581f..c318227ad69 100644 --- a/advisories/github-reviewed/2020/08/GHSA-6898-wx94-8jq8/GHSA-6898-wx94-8jq8.json +++ b/advisories/github-reviewed/2020/08/GHSA-6898-wx94-8jq8/GHSA-6898-wx94-8jq8.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-6898-wx94-8jq8", - "modified": "2021-09-23T20:55:29Z", + "modified": "2023-09-08T20:38:35Z", "published": "2020-08-31T22:50:48Z", "aliases": [ "CVE-2013-7381" ], "summary": "Potential Command Injection in libnotify", - "details": "Versions 1.0.3 and earlier of libnotify are affected by a shell command injection vulnerability. This may result in execution of arbitrary shell commands, if user input is passed into libnotify.notify.\n\nUntrusted input passed in the call to libnotify.notify could result in execution of shell commands. Callers may be unaware of this.\n\n### Example\n```\nvar libnotify = require('libnotify')\nlibnotify.notify('UNTRUSTED INPUT', { title: \\\"\\\" }, function () {\n console.log(arguments);\n})\n```\n\nSpecial thanks to Neal Poole for submitting the pull request to fix this issue.\n\n\n## Recommendation\n\nUpdate to version 1.0.4 or greater", + "details": "Versions 1.0.3 and earlier of libnotify are affected by a shell command injection vulnerability. This may result in execution of arbitrary shell commands, if user input is passed into libnotify.notify.\n\nUntrusted input passed in the call to libnotify.notify could result in execution of shell commands. Callers may be unaware of this.\n\n### Example\n```js\nvar libnotify = require('libnotify')\nlibnotify.notify('UNTRUSTED INPUT', { title: \\\"\\\" }, function () {\n console.log(arguments);\n})\n```\n\nSpecial thanks to Neal Poole for submitting the pull request to fix this issue.\n\n\n## Recommendation\n\nUpdate to version 1.0.4 or greater", "severity": [ { "type": "CVSS_V3", @@ -20,6 +20,11 @@ "ecosystem": "npm", "name": "libnotify" }, + "ecosystem_specific": { + "affected_functions": [ + "" + ] + }, "ranges": [ { "type": "ECOSYSTEM",