CVE-2018-21268 json
Node-Traceroute RCE Vulnerability
published 6y ago modified 4mo ago also GHSA-8j9v-qhp4-wv55 , EUVD-2022-3192
- cvss
- 10.0
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 4.3%
- EPSS 4.3% chance of exploitation in 30 days, percentile 91%
- public exploits
- 0
- none known
Summary
The traceroute (aka node-traceroute) package through 1.0.0 for Node.js allows remote command injection via the host parameter. This occurs because the Child.exec() method, which is considered to be not entirely safe, is used. In particular, an OS command can be placed after a newline character.
Patch / fix
Is CVE-2018-21268 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerExploit prediction
4.29% chance of exploitation in the next 30 days, higher than 91% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 10.0 | CVSS:3.1/AC:L/AV:N/A:L/C:H/I:H/PR:N/S:C/UI:N |
| CNA | 3.1 | 10.0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
| GitHub | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | traceroute | <=1.0.0 |
no fix listed |
Classification
- Weakness
-
- CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component
References
-
github.com
/jaw187/node-traceroute/commit/b99ee024a01a40d3d20a92ad3769cc78a3f6386f
web, patch, third-party-advisory
-
op-c.net
/2020/06/17/shell-command-injection-through-traceroute-npm-package/
exploit, third-party-advisory
-
snyk.io
/vuln/npm:traceroute:20160311
web, exploit, third-party-advisory
-
linkedin.com
/posts/op-innovate_shell-command-injection-through-traceroute-activity-6678956453086191616-Rcpy
web, third-party-advisory
- medium.com /%40shay_62828/shell-command-injection-through-traceroute-npm-package-a4cf7b6553e3
-
github.com
/jaw187/node-traceroute/tags
web, third-party-advisory
-
npmjs.com
/package/traceroute
product, third-party-advisory
-
npmjs.com
/advisories/1465
web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2018-21268
advisory
-
github.com
/jaw187/node-traceroute
package
-
medium.com
/@shay_62828/shell-command-injection-through-traceroute-npm-package-a4cf7b6553e3
web
-
op-c.net
/2020/06/17/shell-command-injection-through-traceroute-npm-package
web
Sources
- CVE List CVE-2018-21268
- GitHub Advisory GHSA-8j9v-qhp4-wv55
- NVD CVE-2018-21268
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.