Read the docs
TI-2021-09864 Aliases CVE-2021-28918GHSA-4c7m-wxvm-r7gc

Improper input validation of octal strings in netmask npm package v1.0.6 and below allows…

Priority MEDIUM 55CWE-704Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · None
Fix status
Partial Red Hat: 1 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-704 and the CVSS impact.

Summary

Improper input validation of octal strings in netmask npm package v1.0.6 and below allows unauthenticated remote attackers to perform indeterminate SSRF, RFI, and LFI attacks on many of the dependent packages. A remote unauthenticated attacker can bypass packages relying on netmask to filter IPs and reach critical VPN or LAN hosts.

Why it matters now

EPSS 0.15037 96th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Partial netmask (npm): 1.1.0Red Hat: 2 advisoriesRed Hat: 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—netmask (npm)before 1.1.01.1.0Patch availableGHSA-4c7m-wxvm-r7gc
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • netmask (npm) Vendor— Affected before 1.1.0 Fixed in 1.1.0 Patch available GHSA-4c7m-wxvm-r7gc

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:netmask_project:netmask:*:*:*:*:*:node.js:*:*up to 1.0.6VulnerableNetmask Project
  • cpe:2.3:a:netmask_project:netmask:*:*:*:*:*:node.js:*:* Versions up to 1.0.6 Vulnerable ·Netmask Project

Remediation

  • Fix · GHSA-4c7m-wxvm-r7gc netmask (npm) Fixed in 1.1.0 Advisory →

Red Hat 2 advisories

  • RHSA-2021:2461 Released 2021-06-16 · Red Hat rating Moderate
    Red Hat Advanced Cluster Management 2.2.4 security and bug fix update
    • Red Hat Advanced Cluster Management for Kubernetes 2.2 for RHEL 7 rhacm2/management-ingress-rhel7, rhacm2/memcached-exporter-rhel7, rhacm2/openshift-hive-rhel7 +2
    • Red Hat Advanced Cluster Management for Kubernetes 2.2 for RHEL 8 rhacm2/acm-must-gather-rhel8, rhacm2/acm-operator-bundle, rhacm2/acmesolver-rhel8 +47
  • RHSA-2021:1499 Released 2021-05-04 · Red Hat rating Moderate
    Red Hat Advanced Cluster Management 2.2.3 security and bug fix update
    • Red Hat Advanced Cluster Management for Kubernetes 2.2 for RHEL 7 rhacm2/management-ingress-rhel7, rhacm2/memcached-exporter-rhel7, rhacm2/openshift-hive-rhel7 +2
    • Red Hat Advanced Cluster Management for Kubernetes 2.2 for RHEL 8 rhacm2/acm-must-gather-rhel8, rhacm2/acm-operator-bundle, rhacm2/acmesolver-rhel8 +47

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Advanced Cluster Management for Kubernetes 2AffectedNo fix yet

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-28918
  2. 2026-10-03 Alias added: GHSA-4c7m-wxvm-r7gc

References

Exploit 2

Advisory 6

Other 4

  • TI-2021-10136 The netmask package before 2.0.1 for Node.js mishandles certain unexpected characters in… CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences