@aragonite/vbox-runner (>=0.0.1 <=0.0.2), @arisan/streamer2 (>=0.0.0 <=0.1.4-alpha.2) +116 more potentially affected by CVE-2024-21488 via network (>=0.0.12 <=0.6.1)

network NPM version =0.0.12, =0.0.1, =0.0.0, =1.0.0, =1.0.0, =0.0.3, =1.0.0, =0.0.0, =0.0.0, =0.0.0-beta.0, =3.0.0, =0.4.0, =1.0.0, =1.2.11 and more Source cves: CVE-2024-21488 Source advisory: OSV:GHSA-VVH2-82C7-PPFG...

CVE-2024-21488

Versions of the package network before 0.7.0 are vulnerable to Arbitrary Command Injection due to use of the childprocess exec function without input sanitization. If attacker-controlled user input is given to the macaddressfor function of the package, it is possible for the attacker to execute...

CVE-2024-21488

Versions of the package network before 0.7.0 are vulnerable to Arbitrary Command Injection due to use of the childprocess exec function without input sanitization. If attacker-controlled user input is given to the macaddressfor function of the package, it is possible for the attacker to execute...

CVE-2024-21488

CVE-2024-21488 affects the Node.js package named network (pre-0.7.0). The vulnerability arises from use of child_process.exec without input sanitization, allowing an attacker-controlled input to reach mac_address_for and execute arbitrary commands on the host OS. Affected versions are those befor...

@aragonite/vbox-runner (>=0.0.1 <=0.0.2), @arisan/streamer2 (>=0.0.0 <=0.1.4-alpha.2) +116 more potentially affected by CVE-2024-21488 via network (>=0.0.12 <=0.6.1)

network NPM version =0.0.12, =0.0.1, =0.0.0, =1.0.0, =1.0.0, =0.0.3, =1.0.0, =0.0.0, =0.0.0, =0.0.0-beta.0, =3.0.0, =0.4.0, =1.0.0, =1.2.11 and more Source cves: CVE-2024-21488 Source advisory: SNYK:JS-NETWORK-6184371...