CVE-2018-16461
Command Injection in libnmap
EPSS 1.4%
Description
Versions of `libnmap` before 0.4.16 are vulnerable to command injection. Proof of concept ```js const nmap = require('libnmap'); const opts = { range: [ 'scanme.nmap.org', "x.x.$(touch success.txt)" ] }; nmap.scan(opts, function(err, report) { if (err) throw new Error(err); for (let item in report) { console.log(JSON.stringify(report[item])); } }); ``` ## Recommendation Update to version 0.4.16 or later
How to fix CVE-2018-16461
To remediate CVE-2018-16461, upgrade the affected package to a fixed version below.
- npm/libnmap—upgrade to 0.4.16 or later
Is CVE-2018-16461 being exploited?
Low — EPSS is 1.4%, meaning exploitation activity has not been observed at scale.
Affected packages (1)
- from 0, < 0.4.16