CVE-2018-13797
CRITICAL 9.8EPSS 6.7%
The macaddress module before 0.2.9 for Node.js is prone to an arbitrary command injection flaw, due to allowing unsanitized input to an exec (rather than execFile) call.
- CVSS v3.0 NVD
- 9.8 CRITICAL
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS v2.0 NVD
- 7.5 HIGH
AV:N/AC:L/Au:N/C:P/I:P/A:P - EPSS
- 6.66% chance of exploitation in the next 30 days, 94th percentile
- Published
- 2018-07-10
- Updated
- 2024-09-16
Proof-of-concept exploits (2)
- dsp-testing/CVE-2018-137970★ · 2021-01-05
- ossf-cve-benchmark/CVE-2018-137970★ · 2020-12-01
Security advisories
- scravy/node-macaddress/pull/20
- https://news.ycombinator.com/item?id=17283394
- advisories/GHSA-pp57-mqmh-44h7