Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.1
Node.js lets attackers execute commands on your server
published 4 days ago
Summary
The current Node.js package can be tricked into running operating system commands that it should not run. This could let a malicious user take control of the server or access sensitive data. Update to the latest Node.js version or apply the vendor's security patch as soon as possible.
What to do
- Update cleanstart nodejs-current to version 18.6.0-r0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | nodejs-current |
< 18.6.0-r0 Fix: upgrade to 18.6.0-r0
|
Original advisory text
OS Command Injection vulnerability exists in Node
Security vulnerability affects the nodejs-current package. A OS Command Injection vulnerability exists in Node.
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Timeline
Published31 Oct 2026
Updated31 Oct 2026
First seen31 Oct 2026
Sources
CLEANSTART-2024-DO47763 · OSV
Track software like this
Free during beta