GitHub Advisoryadvisory · npm

GHSA-vvh2-82c7-ppfg network Arbitrary Command Injection vulnerability

HIGH Published 2024-01-30 Modified 2024-01-30 Official page ↗
Aliases
CVE-2024-21488
Ecosystem
npm
Packages
network
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-77
Reviewed
2024-01-30

Affected packages

• npm network: < 0.7.0 → fixed in 0.7.0

Description

Versions of the package network before 0.7.0 are vulnerable to Arbitrary Command Injection due to use of the `child_process` exec function without input sanitization. If (attacker-controlled) user input is given to the `mac_address_for` function of the package, it is possible for an attacker to execute arbitrary commands on the operating system that this package is being run on.

Related

Alias · CVE (1)

  • CVE-2024-21488 Versions of the package network before 0.7.0 are vulnerable to Arbitrary Command Injection due to use of the child_process exec function… vulnerability

Weakness · CWE (1)

  • CWE-77 Improper Neutralization of Special Elements used in a Command weakness

References