CVE-2018-21268
The traceroute (aka node-traceroute) package through 1.0.0 for Node.js allows remote command injection via the host parameter. This occurs because the Child.exec() method, which…
Published: 2020-06-25 · CVSS: 10.0 · CVSS 3.1
The traceroute (aka node-traceroute) package through 1.0.0 for Node.js allows remote command injection via the host parameter. This occurs because the Child.exec() method, which is considered to be not entirely safe, is used. In particular, an OS command can be placed after a newline character.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7