CVE-2018-13797

The macaddress module before 0.2.9 for Node.js is prone to an arbitrary command injection flaw, due to allowing unsanitized input to an exec (rather than execFile) call.

Score

CVSS 3.0 9.8 Critical

Status

Modified - cve@mitre.org

Published

2018-07-10

Last modified

2024-09-16

Weaknesses

CWE-78

Affected products

• Node-macaddress (Node-macaddress Project)

References

• https://github.com/scravy/node-macaddress/commit/358fd594adb196a86b94ac9c691f69fe5dad2332
• https://github.com/scravy/node-macaddress/pull/20/
• https://github.com/scravy/node-macaddress/releases/tag/0.2.9
• https://news.ycombinator.com/item?id=17283394