CVE-2024-21488 describes an arbitrary command injection vulnerability in the network package prior to version 0.7.0. The issue arises from the use of the child_process exec function without proper input sanitization. When untrusted user input is passed to the mac_address_for function, an attacker may execute arbitrary commands on the host operating system. This vulnerability is remotely exploitable without privileges or user interaction, with a CVSS 3.1 vector indicating network attack vector, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability. There is no vendor advisory or patch information currently available.

Successful exploitation allows an attacker to execute arbitrary commands on the operating system running the vulnerable package. This can lead to partial loss of confidentiality, integrity, and availability of the affected system. The vulnerability is remotely exploitable without authentication or user interaction, increasing the risk of compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, avoid using untrusted input with the mac_address_for function or apply manual input sanitization to prevent command injection.