{"action":"Upgrade nodemailer to 6.4.16 or later.","affected":[{"fixed":"6.4.16","introduced":"0"}],"component":"nodemailer","cve_ids":["CVE-2020-7769"],"ecosystem":"npm","epss":0.02303,"exploited":false,"fixed_versions":["6.4.16"],"ghsa_id":"GHSA-48ww-j4fc-435p","id":"tcs_01M5KEZV94M8DTY9N2D8F7FWE9","modified_at":"2025-01-14T08:57:27.439344Z","published_at":"2021-05-10T19:16:52Z","references":["https://osv.dev/vulnerability/GHSA-48ww-j4fc-435p","https://nvd.nist.gov/vuln/detail/CVE-2020-7769","https://github.com/nodemailer/nodemailer/commit/ba31c64c910d884579875c52d57ac45acc47aa54","https://github.com/nodemailer/nodemailer/blob/33b62e2ea6bc9215c99a9bb4bfba94e2fb27ebd0/lib/sendmail-transport/index.js#L75","https://github.com/nodemailer/nodemailer/blob/33b62e2ea6bc9215c99a9bb4bfba94e2fb27ebd0/lib/sendmail-transport/index.js%23L75","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1039742","https://snyk.io/vuln/SNYK-JS-NODEMAILER-1038834","https://www.npmjs.com/package/nodemailer"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-48ww-j4fc-435p","url":"https://osv.dev/vulnerability/GHSA-48ww-j4fc-435p"}],"summary":"Command injection in nodemailer"}