GitHub Advisoryadvisory · npm

GHSA-pp57-mqmh-44h7 Command Injection in macaddress

CRITICAL Published 2018-09-06 Modified 2021-09-16 Official page ↗
Aliases
CVE-2018-13797
Ecosystem
npm
Packages
macaddress
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-78
Reviewed
2020-06-16

Affected packages

• npm macaddress: < 0.2.9 → fixed in 0.2.9

Description

All versions of `macaddress` are vulnerable to command injection. For this vulnerability to be exploited an attacker needs to control the `iface` argument to the `one` method. Recommendation Update to version 0.2.9 or later.

Related

Alias · CVE (1)

  • CVE-2018-13797 The macaddress module before 0.2.9 for Node.js is prone to an arbitrary command injection flaw, due to allowing unsanitized input to an… vulnerability

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References