description: Growl adds growl notification support to nodejs. Growl before 1.10.2 does not properly sanitize input before passing it to exec, allowing for arbitrary command execution.
problem types: Code Injection (CWE-94)
affected:
{
product: growl node module
vendor: HackerOne
versions:
status: affected, version: <1.10.2
}