What’s Vulnerable › Vulnerabilities

CVE-2018-13797

• Severity: critical (CVSS 9.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 6.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2018-07-10 · updated 2026-06-17
• Weakness: CWE-78

Description

The macaddress module before 0.2.9 for Node.js is prone to an arbitrary command injection flaw, due to allowing unsanitized input to an exec (rather than execFile) call.

Affected products

• Node-Macaddress Project Node-Macaddress: before 0.2.9 — fixed in 0.2.9

How to fix

Upgrade to a fixed version: Node-Macaddress Project Node-Macaddress 0.2.9. Check the vendor advisory for mitigations.

References

• https://github.com/scravy/node-macaddress/commit/358fd594adb196a86b94ac9c691f69fe5dad2332
• https://github.com/scravy/node-macaddress/pull/20/
• https://github.com/scravy/node-macaddress/releases/tag/0.2.9
• https://news.ycombinator.com/item?id=17283394
• https://github.com/scravy/node-macaddress/commit/358fd594adb196a86b94ac9c691f69fe5dad2332
• https://github.com/scravy/node-macaddress/pull/20/
• https://github.com/scravy/node-macaddress/releases/tag/0.2.9
• https://news.ycombinator.com/item?id=17283394

Get alerted when CVE-2018-13797 or the next vulnerability affects your stack