CVEvulnerability
CVE-2018-21268
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2020-06-25
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 10.0 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-74
Description
The traceroute (aka node-traceroute) package through 1.0.0 for Node.js allows remote command injection via the host parameter. This occurs because the Child.exec() method, which is considered to be not entirely safe, is used. In particular, an OS command can be placed after a newline character.
Affected configurations
• traceroute project traceroute (<= 1.0.0)
Related
Weakness · CWE (1)
- CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness
References
- https://github.com/jaw187/node-traceroute/commit/b99ee024a01a40d3d20a92ad3769cc78a3f6386f Patch, Third Party Advisory
- https://github.com/jaw187/node-traceroute/tags Third Party Advisory
- https://medium.com/%40shay_62828/shell-command-injection-through-traceroute-npm-package-a4cf7b6553e3 medium.com
- https://snyk.io/vuln/npm:traceroute:20160311 Exploit, Third Party Advisory
- https://www.linkedin.com/posts/op-innovate_shell-command-injection-through-traceroute-activity-6678956453086191616-Rcpy Third Party Advisory
- https://www.npmjs.com/advisories/1465 Third Party Advisory
- https://www.npmjs.com/package/traceroute Product, Third Party Advisory
- https://www.op-c.net/2020/06/17/shell-command-injection-through-traceroute-npm-package/ Exploit, Third Party Advisory
- https://github.com/jaw187/node-traceroute/commit/b99ee024a01a40d3d20a92ad3769cc78a3f6386f Patch, Third Party Advisory
- https://github.com/jaw187/node-traceroute/tags Third Party Advisory
- https://medium.com/%40shay_62828/shell-command-injection-through-traceroute-npm-package-a4cf7b6553e3 medium.com
- https://snyk.io/vuln/npm:traceroute:20160311 Exploit, Third Party Advisory
- https://www.linkedin.com/posts/op-innovate_shell-command-injection-through-traceroute-activity-6678956453086191616-Rcpy Third Party Advisory
- https://www.npmjs.com/advisories/1465 Third Party Advisory
- https://www.npmjs.com/package/traceroute Product, Third Party Advisory
- https://www.op-c.net/2020/06/17/shell-command-injection-through-traceroute-npm-package/ Exploit, Third Party Advisory