scripts/email.coffee in the Hubot Scripts module before 2.4.4 for Node.js allows remote attackers to execute arbitrary commands.
Node.js
Exploit
CVE-2013-7378
NVD
Refer to CVE-2013-7378 NVD advisory