Command Injection

Overview

The Node.js module node-notifier, used for sending native desktop notifications, is vulnerable to command injection in versions before 9.0.0. The vulnerability stems from insufficient sanitization of the options parameter when it is passed as an array. On Linux systems, this allows an attacker to inject arbitrary shell commands through specially crafted input strings [1][3].

Exploitation

To exploit this vulnerability, an attacker must be able to influence the arguments passed to node-notifier's methods, typically via user-controlled input that ends up in the options array. No authentication is required beyond normal application access, and the attack vector is network-based or local, depending on how the library is used. The library does not properly sanitize array elements before they are used in constructing shell commands, enabling command injection [1][2].

Impact

Successful exploitation permits arbitrary command execution with the privileges of the Node.js process. This can lead to full system compromise, data exfiltration, or lateral movement within the infrastructure. The vulnerability is rated with a high CVSS score, reflecting the severity of remote code execution potential [3].

Mitigation

Users should upgrade node-notifier to version 5.4.5, 8.0.2, or 9.0.1 or later, as these releases include the fix. The patch was committed in commit 5d62799 and ensures proper sanitization of array inputs [2]. The vulnerability is publicly known and was reported by Alessio Della Libera (d3lla) [3].