CVE-2018-21268

CVE-2018-21268 is a critical command injection vulnerability affecting the traceroute (node-traceroute) package up to version 1.0.0 for Node.js. It allows unauthenticated remote attackers to execute arbitrary operating system commands by injecting malicious input into the host parameter, leveraging the unsafe Child.exec() method. This vulnerability carries a CVSS score of 9.8 (Critical) due to its network-based attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. While no public exploits, Metasploit modules, or active exploitation have been identified, and community discussion is minimal, the severe nature of the flaw warrants attention.