Arbitrary Command Injection Affecting libnmap package, versions <0.4.16


0.0
medium

Snyk CVSS

    Attack Complexity Low
    Privileges Required High
    Confidentiality High
    Integrity High
    Availability High

    Threat Intelligence

    EPSS 0.28% (69th percentile)
Expand this section
NVD
9.8 critical

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-JS-LIBNMAP-72551
  • published 4 Nov 2018
  • disclosed 14 Oct 2018
  • credit Cristian-Alexandru Staicu

How to fix?

Upgrade libnmap to version 0.4.16 or higher.

Overview

libnmap is an API to access nmap from node.js.

Affected versions of this package are vulnerable to Arbitrary Command Injection. If the attacker is allowed to provide the "range" field for the network scan, they could inject arbitrary OS commands instead of a valid IP range.