CVE-2013-7378: Command Injection in hubot-scripts
Summary
CVE-2013-7378: Potential Command Injection in hubot-scripts. Affects hubot-scripts versions < 2.4.5. Fixed in 2.4.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
hubot-scripts is an npm package that provides a collection of scripts for Hubot, a popular chatbot framework. These scripts extend the functionality of Hubot by allowing it to perform various tasks. The email script, which is part of hubot-scripts, enables Hubot to send emails. However, versions 2.4.3 and earlier of hubot-scripts are vulnerable to a command injection vulnerability in the email.coffee module.
Vulnerability Detail
The command injection vulnerability in hubot-scripts allows an attacker to execute arbitrary commands on the system running Hubot. This vulnerability exists in the email.coffee module, which fails to properly sanitize user-supplied input before using it in a command execution context. An attacker can exploit this vulnerability by crafting a malicious email address or subject that includes shell commands. If the email script is enabled and a user interacts with Hubot by sending an email with the malicious payload, the injected commands will be executed with the privileges of the user running Hubot. This can lead to unauthorized access, data leakage, or even complete compromise of the system.
How To Fix
Latest published version: 2.17.2 as of 23 Oct 2026
npm install hubot-scripts@2.17.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.4.5
This is the first release that contains the fix.
npm install hubot-scripts@2.4.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating hubot-scripts is not immediately possible, a temporary workaround is to disable the email script in the Hubot configuration. By removing or commenting out the email script from the list of loaded scripts, the vulnerable module will not be used, mitigating the risk of command injection. Here's an example of how to disable the email script:
// In the external-scripts.json file
[
// ... other scripts
// "hubot-email",
// ... other scripts
]
Conclusion
The command injection vulnerability in hubot-scripts can have severe consequences, including unauthorized access and system compromise. It is crucial to update hubot-scripts to the latest version or disable the email script until the update can be applied. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for hubot-scripts →
FAQ
hubot-scripts is an npm package that provides a collection of scripts for Hubot, a chatbot framework.
The email script is a module in hubot-scripts that enables Hubot to send emails.
The vulnerability occurs in the email.coffee module, which fails to properly sanitize user input before using it in a command execution context. An attacker can exploit this by crafting a malicious email address or subject that includes shell commands.
The command injection vulnerability can allow an attacker to execute arbitrary commands on the system running Hubot. This can lead to unauthorized access, data leakage, or complete compromise of the system.
To fix this vulnerability, update hubot-scripts to version 2.4.4 or later. Alternatively, you can disable the email script in the Hubot configuration as a temporary workaround.
