GHSA-8J9V-QHP4-WV55 Node-Traceroute RCE Vulnerability

The traceroute aka node-traceroute package through 1.0.0 for Node.js allows remote command injection via the host parameter. This occurs because the Child.exec method, which is considered to be not entirely safe, is used. In particular, an OS command can be placed after a newline character...

OS Command Injection

node-traceroute is vulnerable to OS command injection. The Child.exec method accepts untrusted user input and allows an attacker to inject arbitrary OS commands after a newline character...