{"cve":"CVE-2021-28918","nvd":{"published":"2021-04-01T13:15:14.460","modified":"2026-06-17T03:47:02.553","status":"Modified","description":"Improper input validation of octal strings in netmask npm package v1.0.6 and below allows unauthenticated remote attackers to perform indeterminate SSRF, RFI, and LFI attacks on many of the dependent packages. A remote unauthenticated attacker can bypass packages relying on netmask to filter IPs and reach critical VPN or LAN hosts.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","score":9.1},"cwes":["CWE-704"],"references":["https://github.com/advisories/GHSA-pch5-whg9-qr2r","https://github.com/rs/node-netmask","https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-011.md","https://rootdaemon.com/2021/03/29/vulnerability-in-netmask-npm-package-affects-280000-projects/","https://security.netapp.com/advisory/ntap-20210528-0010/"],"products":["netmask_project:netmask"],"source":"nvd","synced_at":"2026-10-19T21:17:01.373894544+00:00"},"epss":{"cve":"CVE-2021-28918","score":0.15037,"percentile":0.96725,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-4c7m-wxvm-r7gc","url":"https://osv.dev/vulnerability/GHSA-4c7m-wxvm-r7gc","summary":"Improper parsing of octal bytes in netmask","modified":"2026-09-10T03:49:26.521770326Z","packages":[{"ecosystem":"npm","name":"netmask","purl":"pkg:npm/netmask","ranges":["<1.1.0"],"fixed":["1.1.0"]}]},{"id":"GHSA-pch5-whg9-qr2r","url":"https://osv.dev/vulnerability/GHSA-pch5-whg9-qr2r","summary":"netmask npm package mishandles octal input data","modified":"2026-09-10T03:49:14.440382329Z","packages":[{"ecosystem":"npm","name":"netmask","purl":"pkg:npm/netmask","ranges":["<2.0.1"],"fixed":["2.0.1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}