critical9.8
CVE-2018-13797
The macaddress module before 0.2.9 for Node.js is prone to an arbitrary command injection flaw, due to allowing unsanitized input to an exec (rather than execF…
Impact
The macaddress module before 0.2.9 for Node.js is prone to an arbitrary command injection flaw, due to allowing unsanitized input to an exec (rather than execFile) call.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Node-Macaddress Project | Node-Macaddress | before 0.2.9 |
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/scravy/node-macaddress/commit/358fd594adb196a86b94ac9c691f69fe5dad2332
- https://github.com/scravy/node-macaddress/pull/20/
- https://github.com/scravy/node-macaddress/releases/tag/0.2.9
- https://news.ycombinator.com/item?id=17283394
- https://github.com/scravy/node-macaddress/commit/358fd594adb196a86b94ac9c691f69fe5dad2332
- https://github.com/scravy/node-macaddress/pull/20/
- https://github.com/scravy/node-macaddress/releases/tag/0.2.9
- https://news.ycombinator.com/item?id=17283394