CVE catalog

CVE-2018-13797

node-macaddress: CVE-2018-13797

[CVE catalog]

Severity
Critical · CVSS 9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
6.66% · Oct 27, 2026

The macaddress module before 0.2.9 for Node.js is prone to an arbitrary command injection flaw, due to allowing unsanitized input to an exec (rather than execFile) call.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiannode-macaddresssid0.5.4-1fixed
Debiannode-macaddressforky0.5.4-1fixed
Debiannode-macaddresstrixie0.5.3-2fixed
Debiannode-macaddressbookworm0.5.3-2fixed
Ubuntunode-macaddress18.040.2.8-1vulnerable
Ubuntunode-macaddress18.040.2.8-2vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiannode-macaddresssourcesid0.2.9-1unimportantNot reportedNot reported
Debiannode-macaddresssourceforky0.2.9-1unimportantNot reportedNot reported
Debiannode-macaddresssourcetrixie0.2.9-1unimportantNot reportedNot reported
Debiannode-macaddresssourcebookworm0.2.9-1unimportantNot reportedNot reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [node-macaddress]Fixed
    Details (2)

    • 0.5.3-2 · all · bookworm

      Fixed · Fixed: 0.2.9-1

      dsa · node-macaddress · debian · bookworm; dsa · node-macaddress · debian · 12

    • 0.5.3-2 · all · bookworm

      Fixed · Fixed: 0.2.9-1

      dsa · node-macaddress · debian · bookworm; dsa · node-macaddress · debian · 12

[Debian 13 (Trixie)]

  • [node-macaddress]Fixed
    Details (2)

    • 0.5.3-2 · all · trixie

      Fixed · Fixed: 0.2.9-1

      dsa · node-macaddress · debian · 13

    • 0.5.3-2 · all · trixie

      Fixed · Fixed: 0.2.9-1

      dsa · node-macaddress · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]