CVE-2018-21268: Traceroute Project Traceroute

Critical severity, CVSS 9.8. EPSS: 4.3% chance of exploitation in the next 30 days.

The traceroute (aka node-traceroute) package through 1.0.0 for Node.js allows remote command injection via the host parameter. This occurs because the Child.exec() method, which is considered to be not entirely safe, is used. In particular, an OS command can be placed after a newline character.

Affected products

• Traceroute Project Traceroute: up to and including 1.0.0

Published 2020-06-25. Last modified 2026-06-17.