TI-2018-02779 Aliases CVE-2018-3786 GHSA-c9j3-wqph-5xx9

Command injection in egg-scripts

MEDIUM 56CWE-77Published 2018-08-24 · Updated 2024-09-16

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-77.

Summary

A command injection vulnerability in egg-scripts <v2.8.1 allows arbitrary shell command execution through a maliciously crafted command line argument.

Why it matters now

EPSS 0.12283 96th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed egg-scripts (npm): 2.8.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Egg	egg-scripts	2.8.1	—	No fix listed	CNA
—	egg-scripts (npm)	before 2.8.1	2.8.1	Patch available	GHSA-c9j3-wqph-5xx9

egg-scripts VendorEgg Affected 2.8.1 Fixed in — No fix listed CNA
egg-scripts (npm) Vendor— Affected before 2.8.1 Fixed in 2.8.1 Patch available GHSA-c9j3-wqph-5xx9

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:eggjs:egg-scripts::::::node.js::*	before 2.8.1	Vulnerable	Eggjs

cpe:2.3:a:eggjs:egg-scripts:*:*:*:*:*:node.js:*:* Versions before 2.8.1 Vulnerable ·Eggjs

Remediation

Fix · GHSA-c9j3-wqph-5xx9 egg-scripts (npm) Fixed in 2.8.1 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2018-3786
2026-10-03 Alias added: GHSA-c9j3-wqph-5xx9

References

Exploit 1

https://hackerone.com/reports/388936

Patch 1

https://github.com/eggjs/egg-scripts/pull/26

Advisory 3

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences