CVE-2024-21488

CriticalCVSS 9.8/10Last modified Jul 4, 2026

Description

Versions of the package network before 0.7.0 are vulnerable to Arbitrary Command Injection due to use of the child_process exec function without input sanitization. If (attacker-controlled) user input is given to the mac_address_for function of the package, it is possible for the attacker to execute arbitrary commands on the operating system that this package is being run on.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

No affected versions have been published.

Timeline

Published
Jan 30, 2024
Last modified
Jul 4, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-214898.2Versions of the package uplot before 1.6.31 are vulnerable to Prototype Pollution via the uplot.assign function due to missing check if the CVE-2024-21497.2A vulnerability classified as critical was found in CodeAstro Membership Management System 1.0. This vulnerability affects unknown code of tCVE-2024-214907.5This affects versions of the package angular from 1.3.0; versions of the package angularjs from 1.3.0. A regular expression used to split thCVE-2024-214916.5Versions of the package svix before 1.17.0 are vulnerable to Authentication Bypass due to an issue in the verify function where signatures oCVE-2024-214928.1All versions of the package github.com/greenpau/caddy-security are vulnerable to Insufficient Session Expiration due to improper user sessioCVE-2024-214935.3All versions of the package github.com/greenpau/caddy-security are vulnerable to Improper Validation of Array Index when parsing a CaddyfileCVE-2024-214945.4All versions of the package github.com/greenpau/caddy-security are vulnerable to Authentication Bypass by Spoofing via the X-Forwarded-For hCVE-2024-214959.8Versions of the package github.com/greenpau/caddy-security before 1.0.42 are vulnerable to Insecure Randomness due to using an insecure randCVE-2024-214966.1All versions of the package github.com/greenpau/caddy-security are vulnerable to Cross-site Scripting (XSS) via the Referer header, due to iCVE-2024-214976.1Versions of the package github.com/greenpau/caddy-security are vulnerable to Open Redirect via the redirect_url parameter. An attacker coulCVE-2024-214985.3All versions of the package github.com/greenpau/caddy-security are vulnerable to Server-side Request Forgery (SSRF) via X-Forwarded-Host heaCVE-2024-214994.3All versions of the package github.com/greenpau/caddy-security are vulnerable to HTTP Header Injection via the X-Forwarded-Proto header due
CVE-2024-21488: Critical severity, CVSS 9.8 | Vulnix