CVE-2020-7769: Command injection in nodemailer
Summary
CVE-2020-7769: Command injection in nodemailer. Affects nodemailer versions < 6.4.16. Fixed in 6.4.16. How to fix ↓
Also tracked for
- node-nodemailer · Debian:11
The same CVE-2020-7769 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Nodemailer is an open-source package for Node.js that allows users to send emails. It provides a simple and straightforward API for sending emails using various transport methods. The package is widely used in Node.js applications for email functionality.
Vulnerability Detail
The vulnerability identified as CVE-2020-7769 in nodemailer versions before 6.4.16 allows for command injection when using crafted recipient email addresses with the sendmail transport method. This can lead to arbitrary command flag injection, potentially enabling an attacker to execute arbitrary commands on the host system. The vulnerability has a CVSS score of 9.8, indicating its critical severity.
How To Fix
Latest published version: 10.2.1 as of 22 Oct 2026
npm install nodemailer@10.2.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6.4.16
This is the first release that contains the fix.
npm install nodemailer@6.4.16Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the fixed version is not immediately possible, a workaround can be implemented by validating and sanitizing recipient email addresses before passing them to the sendmail transport method. This can help prevent the injection of arbitrary command flags. Here's an example of how to sanitize the recipient email address in Node.js:
const recipient = sanitizeEmail(recipientEmail);
Conclusion
In conclusion, the command injection vulnerability in nodemailer versions before 6.4.16 can be mitigated by upgrading to the fixed version or implementing a workaround. It is crucial to take immediate action to protect your application from potential exploitation. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for nodemailer →
FAQ
Nodemailer is an open-source package for Node.js that provides an easy-to-use API for sending emails.
The vulnerability allows for command injection, potentially enabling an attacker to execute arbitrary commands on the host system.
To fix this vulnerability, upgrade nodemailer to version 6.4.16 or later.
Yes, you can sanitize and validate recipient email addresses before passing them to the sendmail transport method.
The vulnerability has a CVSS score of 9.8, indicating its critical severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for nodemailer.
