CVE-2020-7789: OS Command Injection in node-notifier
Summary
CVE-2020-7789: OS Command Injection in node-notifier. Affects node-notifier versions < 8.0.1. Fixed in 8.0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
node-notifier is an npm package that provides a simple way to display native system notifications on various platforms. It is commonly used in Node.js applications to send notifications to users. However, versions before 8.0.1 are vulnerable to OS command injection. This vulnerability allows an attacker to execute arbitrary commands on Linux machines by exploiting the lack of sanitization of options params when passed as an array.
Vulnerability Detail
The OS command injection vulnerability in node-notifier arises from the insecure handling of user-supplied input. By crafting a malicious array of options, an attacker can inject arbitrary commands that will be executed on the target Linux machine. This can lead to unauthorized access, data leakage, or even complete compromise of the system. The vulnerability has a CVSS score of 5.6, indicating a moderate severity level.
How To Fix
Latest published version: 11.0.0 as of 22 Oct 2026
npm install node-notifier@11.0.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
8.0.1
This is the first release that contains the fix.
npm install node-notifier@8.0.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to avoid passing user-controlled input as an array in the options params. Instead, it is recommended to sanitize and validate user input before passing it to the node-notifier package.
Conclusion
In conclusion, the OS command injection vulnerability in node-notifier can be mitigated by upgrading to version 8.0.1 or later. Developers should ensure that user input is properly sanitized and validated to prevent similar vulnerabilities in the future. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for node-notifier →
FAQ
node-notifier is an npm package used to display native system notifications in Node.js applications.
OS command injection is a vulnerability that allows an attacker to execute arbitrary commands on a target system by injecting malicious input.
This vulnerability in node-notifier can lead to unauthorized access, data leakage, or complete compromise of the target Linux machine.
To fix this vulnerability, upgrade to node-notifier version 8.0.1 or later.
Yes, if upgrading immediately is not possible, avoid passing user-controlled input as an array in the options params.
