Vulnerability DatabaseCVE-2018-3772
Mend.io Vulnerability Database
The largest open source vulnerability database
What is a Vulnerability ID?
New vulnerability? Tell us about it!
CVE-2018-3772
Published:July 30, 2018
Updated:September 21, 2026
Concatenating unsanitized user input in the "whereis" npm module < 0.4.1 allowed an attacker to execute arbitrary commands. The "whereis" module is deprecated and it is recommended to use the "which" npm module instead.
Affected Packages
whereis (NPM):
Affected version(s) >=0.0.1 <0.4.1
Fix Suggestion:
Update to version 0.4.1
Additional Notes
The description of this vulnerability differs from MITRE.
Related Resources (5)
https://nvd.nist.gov/vuln/detail/CVE-2018-3772
https://hackerone.com/reports/319476
https://github.com/advisories/GHSA-wjr4-2jgw-hmv8
https://github.com/vvo/node-whereis/commit/0f64e3780235004fb6e43bfd153ea3e0e210ee2b
https://www.npmjs.com/advisories/604
Do you need more information?
Contact Us
CVSS v4
Base Score:
9.3
Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
NONE
User Interaction
NONE
Vulnerable System Confidentiality
HIGH
Vulnerable System Integrity
HIGH
Vulnerable System Availability
HIGH
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
9.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH
Weakness Type (CWE)
Improper Input Validation
CWE-20
Improper Neutralization of Special Elements used in a Command ('Command Injection')
CWE-77
EPSS
Base Score:
2.53