CVE-2024-21488

Katalog CVE

CVSS 9.8 · Critical EPSS 3,3%

Kerentanan Improper Neutralization of Special Elements used in a Command ('Command Injection') pada forkhq network. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Versions of the package network before 0.7.0 are vulnerable to Arbitrary Command Injection due to use of the child_process exec function without input sanitization. If (attacker-controlled) user input is given to the mac_address_for function of the package, it is possible for the attacker to execute arbitrary commands on the operating system that this package is being run on.

Rincian

Terbit di NVD

30 Januari 2024

Terakhir diubah

4 Juli 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')

EPSS (30 hari)

3,3% peluang dieksploitasi; lebih tinggi dari 88,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/tomas/network/commit/5599ed6d6ff1571a5ccadea775430c131f381de7 patch
• https://github.com/tomas/network/commit/6ec8713580938ab4666df2f2d0f3399891ed2ad7 patch
• https://github.com/tomas/network/commit/72c523265940fe279eb0050d441522628f8988e5 patch
• https://gist.github.com/icemonster/282ab98fb68fc22aac7c576538f6369c exploit · mitigasi · advisory pihak ketiga
• https://security.snyk.io/vuln/SNYK-JS-NETWORK-6184371 exploit · advisory pihak ketiga
• https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-11426552