CVE-2013-7381: Command Injection in libnotify
Summary
CVE-2013-7381: Potential Command Injection in libnotify. Affects libnotify versions < 1.0.4. Fixed in 1.0.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libnotify is an npm package that provides a notification system for Node.js applications. It allows developers to display desktop notifications to users. However, versions 1.0.3 and earlier of libnotify are affected by a critical shell command injection vulnerability. This vulnerability can be exploited if user input is passed into the libnotify.notify function, potentially leading to the execution of arbitrary shell commands. It is important to note that callers may be unaware of this issue.
Vulnerability Detail
The vulnerability in libnotify arises from the lack of proper input validation and sanitization. When untrusted input is passed to the libnotify.notify function, it is not properly handled, allowing an attacker to inject malicious shell commands. This can result in the execution of arbitrary commands with the privileges of the user running the Node.js application. The impact of this vulnerability can be severe, as it enables an attacker to execute unauthorized actions on the affected system.
How To Fix
Latest published version: 1.0.4 as of 23 Oct 2026
npm install libnotify@1.0.4The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating to the latest version of libnotify is not immediately feasible, a temporary workaround can be implemented. Developers should ensure that any user input passed to the libnotify.notify function is properly validated and sanitized to prevent command injection. This can be achieved by using input validation techniques such as whitelisting or input sanitization libraries.
Conclusion
The command injection vulnerability in libnotify (CVE-2013-7381) poses a significant risk to Node.js applications using affected versions. It allows for the execution of arbitrary shell commands, potentially leading to unauthorized actions and compromise of the system. To mitigate this vulnerability, it is crucial to update libnotify to version 1.0.4 or later. Developers should also ensure proper input validation and sanitization when passing user input to the libnotify.notify function. For additional support and guidance, please reach out to DevNack.com.
See every vulnerability recorded for libnotify →
FAQ
The vulnerability allows an attacker to execute arbitrary shell commands with the privileges of the user running the Node.js application. This can lead to unauthorized actions and potential compromise of the affected system.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the package-lock.json file.
Yes, the CVSS score for this vulnerability is 9.8, indicating its critical severity.
At the time of this advisory, there are no known public exploits specifically targeting this vulnerability. However, it is crucial to address this issue promptly to mitigate the risk of potential exploitation.
For further support and assistance in remediating this vulnerability, you can contact info@devnack.com.
Related vulnerabilities
Recent vulnerabilities recorded for libnotify.
