~ / search / GHSA-vvh2-82c7-ppfg

GHSA-vvh2-82c7-ppfg

network Arbitrary Command Injection vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2024-21488

Packages

EcosystemPackageAffectedFixed in
npm network < 0.7.0 0.7.0

Details

As written in the advisory (Markdown source, shown as plain text).

Versions of the package network before 0.7.0 are vulnerable to Arbitrary Command Injection due to use of the `child_process` exec function without input sanitization. If (attacker-controlled) user input is given to the `mac_address_for` function of the package, it is possible for an attacker to execute arbitrary commands on the operating system that this package is being run on.

References

External links from the advisory. They lead to third-party sites.