VULNERABILITY INTELLIGENCE

CVE-2024-21488

CVSS score7.3 HIGH
EPSS probability3.30%
CISA KEVNot currently listed
Published2024-01-30
Last modified2026-07-04
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Description

Versions of the package network before 0.7.0 are vulnerable to Arbitrary Command Injection due to use of the child_process exec function without input sanitization. If (attacker-controlled) user input is given to the mac_address_for function of the package, it is possible for the attacker to execute arbitrary commands on the operating system that this package is being run on.

Weakness classification

  • report@snyk.io: CWE-77
  • nvd@nist.gov: CWE-77

Primary references