CVE-2018-3786: Command Injection in egg-scripts
Summary
CVE-2018-3786: Command Injection in egg-scripts. Affects egg-scripts versions < 2.8.1. Fixed in 2.8.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The egg-scripts package is an npm package used for managing and running Egg.js applications. It provides a command-line interface (CLI) tool called eggctl for starting, stopping, and managing Egg.js applications. The package is vulnerable to command injection, which can be exploited if a malicious argument is provided on the command line.
Vulnerability Detail
The command injection vulnerability in egg-scripts allows an attacker to execute arbitrary commands on the host system by injecting malicious arguments. This can lead to various consequences, such as unauthorized access, data leakage, or even complete compromise of the host system. The vulnerability has a CVSS score of 9.8, indicating its critical severity.
How To Fix
Latest published version: 3.1.0 as of 23 Oct 2026
npm install egg-scripts@3.1.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.8.1
This is the first release that contains the fix.
npm install egg-scripts@2.8.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating to the latest version is not immediately feasible, a temporary workaround is to avoid passing untrusted or user-controlled input as command-line arguments to the eggctl tool. Instead, ensure that any user input is properly validated and sanitized before being used as arguments.
Conclusion
The egg-scripts package is vulnerable to command injection, which can be exploited by providing a malicious argument on the command line. To mitigate this vulnerability, it is crucial to update to version 2.8.1 or later of the package. If immediate update is not possible, ensure that user input is properly validated and sanitized before being used as command-line arguments. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for egg-scripts →
FAQ
egg-scripts is an npm package used for managing and running Egg.js applications. It provides a command-line interface (CLI) tool called eggctl for starting, stopping, and managing Egg.js applications.
Command injection is a vulnerability that allows an attacker to execute arbitrary commands on a host system by injecting malicious input into a command execution context.
This vulnerability can be exploited by providing a malicious argument on the command line when using the eggctl tool. If the input is not properly validated or sanitized, an attacker can inject arbitrary commands.
The consequences of this vulnerability can include unauthorized access, data leakage, or complete compromise of the host system. An attacker can execute arbitrary commands with the privileges of the user running the eggctl tool.
This vulnerability has a CVSS score of 9.8, indicating its critical severity.
