CVE-2024-21488: Forkhq Network

Critical severity, CVSS 9.8. EPSS: 3.3% chance of exploitation in the next 30 days.

Versions of the package network before 0.7.0 are vulnerable to Arbitrary Command Injection due to use of the child_process exec function without input sanitization. If (attacker-controlled) user input is given to the mac_address_for function of the package, it is possible for the attacker to execute arbitrary commands on the operating system that this package is being run on.

Affected products

• Forkhq Network: before 0.7.0 (fixed in 0.7.0)

Published 2024-01-30. Last modified 2026-07-04.