---
id: CVE-2024-21488
title: >-
  Versions of the package network before 0.7.0 are vulnerable to Arbitrary
  Command Injection due to use of the child_process exec function without input
  sanitization
summary: >-
  Versions of the package network before 0.7.0 are vulnerable to Arbitrary
  Command Injection due to use of the child_process exec function without input
  sanitization. If (attacker-controlled) user input is given to the
  mac_address_for func…
severity: high
cvss: 7.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L'
cwe:
  - CWE-77
  - CWE-77
vendor: forkhq
product: network
affected:
  - network < 0.7.0
patched:
  - network 0.7.0
published: '2024-01-30'
updated: '2026-07-04'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2024-21488'
references:
  - url: 'https://gist.github.com/icemonster/282ab98fb68fc22aac7c576538f6369c'
    label: report@snyk.io
  - url: >-
      https://github.com/tomas/network/commit/5599ed6d6ff1571a5ccadea775430c131f381de7
    label: report@snyk.io
  - url: >-
      https://github.com/tomas/network/commit/6ec8713580938ab4666df2f2d0f3399891ed2ad7
    label: report@snyk.io
  - url: >-
      https://github.com/tomas/network/commit/72c523265940fe279eb0050d441522628f8988e5
    label: report@snyk.io
  - url: 'https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-11426552'
    label: report@snyk.io
  - url: 'https://security.snyk.io/vuln/SNYK-JS-NETWORK-6184371'
    label: report@snyk.io
  - url: 'https://gist.github.com/icemonster/282ab98fb68fc22aac7c576538f6369c'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://github.com/tomas/network/commit/5599ed6d6ff1571a5ccadea775430c131f381de7
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://github.com/tomas/network/commit/6ec8713580938ab4666df2f2d0f3399891ed2ad7
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://github.com/tomas/network/commit/72c523265940fe279eb0050d441522628f8988e5
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://security.snyk.io/vuln/SNYK-JS-NETWORK-6184371'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
epss: 0.03302
epssPercentile: 0.88054
ingestedAt: '2026-07-04T16:56:19.039Z'
---

## Overview

Versions of the package network before 0.7.0 are vulnerable to Arbitrary Command Injection due to use of the child_process exec function without input sanitization. If (attacker-controlled) user input is given to the mac_address_for function of the package, it is possible for the attacker to execute arbitrary commands on the operating system that this package is being run on.

## Affected

- `network < 0.7.0`

## Remediation

Upgrade past the affected range:

- `network 0.7.0`