Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXJqdmotNjczcS00aGZ3
Command Injection in traceroute
All versions of traceroute
are vulnerable to Command Injection. The package fails to sanitize input and passes it directly to an exec
call, which may allow attackers to execute arbitrary code in the system. The trace
function is vulnerable and can be abused if the host
value is controlled by an attacker.
Recommendation
No fix is currently available. Consider using an alternative package until a fix is made available.
Permalink: https://github.com/advisories/GHSA-rjvj-673q-4hfwJSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXJqdmotNjczcS00aGZ3
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: over 3 years ago
Updated: over 1 year ago
Identifiers: GHSA-rjvj-673q-4hfw
References:
- https://snyk.io/vuln/npm:traceroute:20160311
- https://www.npmjs.com/advisories/1465
- https://github.com/jaw187/node-traceroute
- https://github.com/advisories/GHSA-rjvj-673q-4hfw
Blast Radius: 0.0
Affected Packages
npm:traceroute
Dependent packages: 6Dependent repositories: 64
Downloads: 3,034 last month
Affected Version Ranges: >= 0.0.0
No known fixed version
All affected versions: 0.0.1, 0.0.2, 0.0.3, 1.0.0