CVE-2018-21268

The traceroute (aka node-traceroute) package through 1.0.0 for Node.js allows remote command injection via the host parameter. This occurs because the Child.exec() method, which is considered to be not entirely safe, is used. In particular, an OS command can be placed after a newline character.

• CWE-74

• https://github.com/jaw187/node-traceroute/commit/b99ee024a01a40d3d20a92ad3769cc78a3f6386fPatch, Third Party Advisory
• https://github.com/jaw187/node-traceroute/tagsThird Party Advisory
• https://medium.com/%40shay_62828/shell-command-injection-through-traceroute-npm-package-a4cf7b6553e3
• https://snyk.io/vuln/npm:traceroute:20160311Exploit, Third Party Advisory
• https://www.linkedin.com/posts/op-innovate_shell-command-injection-through-traceroute-activity-6678956453086191616-RcpyThird Party Advisory
• https://www.npmjs.com/advisories/1465Third Party Advisory
• https://www.npmjs.com/package/tracerouteProduct, Third Party Advisory
• https://www.op-c.net/2020/06/17/shell-command-injection-through-traceroute-npm-package/Exploit, Third Party Advisory
• https://github.com/jaw187/node-traceroute/commit/b99ee024a01a40d3d20a92ad3769cc78a3f6386fPatch, Third Party Advisory
• https://github.com/jaw187/node-traceroute/tagsThird Party Advisory
• https://medium.com/%40shay_62828/shell-command-injection-through-traceroute-npm-package-a4cf7b6553e3
• https://snyk.io/vuln/npm:traceroute:20160311Exploit, Third Party Advisory
• https://www.linkedin.com/posts/op-innovate_shell-command-injection-through-traceroute-activity-6678956453086191616-RcpyThird Party Advisory
• https://www.npmjs.com/advisories/1465Third Party Advisory
• https://www.npmjs.com/package/tracerouteProduct, Third Party Advisory
• https://www.op-c.net/2020/06/17/shell-command-injection-through-traceroute-npm-package/Exploit, Third Party Advisory

Published

Jun 25, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-21262An issue was discovered in Mattermost Server before 4.7.3. I…7.5
• CVE-2018-21263An issue was discovered in Mattermost Server before 4.7.0, 4…8.8
• CVE-2018-21264An issue was discovered in Mattermost Server before 4.7.0, 4…8.8
• CVE-2018-21265An issue was discovered in Mattermost Desktop App before 4.0…5.3
• CVE-2018-21266Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2018-21267Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2018-21269checkpath in OpenRC through 0.42.1 might allow local users t…5.5
• CVE-2018-2127Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2018-21270Versions less than 0.0.6 of the Node.js stringstream module …6.5
• CVE-2018-2128Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2018-2129Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2018-2130Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…