CVE-2024-21488 affects the 'network' package versions prior to 0.7.0. The vulnerability arises from the use of the child_process exec function without proper input sanitization in the mac_address_for function. An attacker supplying crafted input can execute arbitrary commands on the host operating system. The CVSS 3.1 base score is 7.3, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available.

Successful exploitation allows an unauthenticated attacker to execute arbitrary commands on the operating system where the vulnerable package is used. This can lead to partial loss of confidentiality, integrity, and availability of the affected system. The vulnerability is exploitable remotely without user interaction or privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using untrusted input with the mac_address_for function or apply manual input sanitization to prevent command injection.