Command Injection in macaddress

CRITICAL 9.8CVE-2018-13797 · GHSA-pp57-mqmh-44h7 · Published 10/07/2018 · updated 17/06/2026

In short

CVE-2018-13797 is a CRITICAL (CVSS 9.8) vulnerability affecting node-macaddress (node-macaddress project), macaddress.
Chance of exploitation in the next 30 days (EPSS): 6.7%, higher than 93.9% of all vulnerabilities.
Fix: update to 0.2.9 or later.

Package	Affected versions	Patched versions
node-macaddress node-macaddress_project	`< 0.2.9`	`0.2.9`
macaddress npm	`< 0.2.9`	`0.2.9`

Description

All versions of macaddress are vulnerable to command injection. For this vulnerability to be exploited an attacker needs to control the iface argument to the one method.

Recommendation

Update to version 0.2.9 or later.

NVD description

The macaddress module before 0.2.9 for Node.js is prone to an arbitrary command injection flaw, due to allowing unsanitized input to an exec (rather than execFile) call.

References

nvd.nist.gov/vuln/detail/CVE-2018-13797 · ADVISORY
scravy/node-macaddress#20 · WEB
scravy/node-macaddress commit 358fd59 · WEB
hackerone.com/reports/319467 · WEB
GitHub Advisory GHSA-pp57-mqmh-44h7 · ADVISORY
scravy/node-macaddress · PACKAGE
scravy/node-macaddress release 0.2.9 · WEB
news.ycombinator.com/item · WEB
npmjs.com/advisories/654 · WEB
scravy/node-macaddress#20 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free