Critical severity9.8NVD Advisory· Published Aug 24, 2018· Updated Jun 17, 2026

CVE-2018-3786

Description

A command injection vulnerability in egg-scripts <v2.8.1 allows arbitrary shell command execution through a maliciously crafted command line argument.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
egg-scriptsnpm	< 2.8.1	2.8.1

Affected products

Eggjs/Egg Scripts
cpe:2.3:a:eggjs:egg-scripts:*:*:*:*:*:node.js:*:*
Range: <2.8.1
ghsa-coords
pkg:npm/egg-scripts
Range: < 2.8.1
Egg/Egg Scriptsv5
Range: 2.8.1

Patches

Vulnerability mechanics

References

github.com/eggjs/egg-scripts/pull/26nvdPatchThird Party AdvisoryWEB
hackerone.com/reports/388936nvdExploitPatchThird Party AdvisoryWEB
github.com/advisories/GHSA-c9j3-wqph-5xx9ghsaADVISORY
github.com/eggjs/egg-scripts/blob/2.8.1/History.mdnvdRelease NotesThird Party AdvisoryWEB
nvd.nist.gov/vuln/detail/CVE-2018-3786ghsaADVISORY
github.com/eggjs/egg-scripts/commit/b98fd03d1e3aaed68004b881f0b3d42fe47341ddghsaWEB
www.npmjs.com/advisories/694ghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.010
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000