EUVD-2022-3192

🗓️ 03 Oct 2025 20:07:09Reported by EUVDType

Traceroute package for Node.js allows remote command injection via unsafe Child.exec() method

Reporter	Title	Published	Views	Family All 12
GithubExploit	Exploit for Injection in Traceroute_Project Traceroute	21 May 202600:20	–	githubexploit
Circl	CVE-2018-21268	25 Jun 202020:55	–	circl
CNVD	traceroute injection vulnerability	28 Jun 202000:00	–	cnvd
CVE	CVE-2018-21268	25 Jun 202016:56	–	cve
Cvelist	CVE-2018-21268	25 Jun 202016:56	–	cvelist
Github Security Blog	Node-Traceroute RCE Vulnerability	24 May 202217:21	–	github
NVD	CVE-2018-21268	25 Jun 202017:15	–	nvd
OSV	GHSA-8J9V-QHP4-WV55 Node-Traceroute RCE Vulnerability	24 May 202217:21	–	osv
Prion	Command injection	25 Jun 202017:15	–	prion
RedhatCVE	CVE-2018-21268	9 Jan 202608:55	–	redhatcve

[
  {
    "enisaIdVendor": [
      {
        "id": "888a18a5-6a8f-3343-b5a5-ce0b71f6fdd3",
        "vendor": {
          "name": "n/a"
        }
      }
    ],
    "enisaIdProduct": [
      {
        "id": "fc6e35c5-ae7f-34cb-b779-0d597aa1b934",
        "product": {
          "name": "n/a"
        },
        "product_version": "n/a"
      }
    ]
  }
]

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2018-21268
github	www.github.com/jaw187/node-traceroute/commit/b99ee024a01a40d3d20a92ad3769cc78a3f6386f
github	www.github.com/jaw187/node-traceroute
github	www.github.com/jaw187/node-traceroute/tags
medium	www.medium.com/@shay_62828/shell-command-injection-through-traceroute-npm-package-a4cf7b6553e3
snyk	www.snyk.io/vuln/npm:traceroute:20160311
linkedin	www.linkedin.com/posts/op-innovate_shell-command-injection-through-traceroute-activity-6678956453086191616-Rcpy
npmjs	www.npmjs.com/advisories/1465
op-c	www.op-c.net/2020/06/17/shell-command-injection-through-traceroute-npm-package
op-c	www.op-c.net/2020/06/17/shell-command-injection-through-traceroute-npm-package/

03 Oct 2025 20:07Current

9.1High risk

Vulners AI Score9.1

CVSS 3.19.8 - 10

CVSS 27.5

EPSS0.06517