cve/2024/CVE-2024-21488.md

### [CVE-2024-21488](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21488)
![](https://img.shields.io/static/v1?label=Product&message=network&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=0%3C%200.7.0%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=Arbitrary%20Command%20Injection&color=brighgreen)

### Description

Versions of the package network before 0.7.0 are vulnerable to Arbitrary Command Injection due to use of the child_process exec function without input sanitization. If (attacker-controlled) user input is given to the mac_address_for function of the package, it is possible for the attacker to execute arbitrary commands on the operating system that this package is being run on.

### POC

#### Reference
- https://gist.github.com/icemonster/282ab98fb68fc22aac7c576538f6369c
- https://security.snyk.io/vuln/SNYK-JS-NETWORK-6184371

#### Github
No PoCs found on GitHub currently.