# CVE-2017-16100: dns-sync command injection in resolve method

Source: https://junglewise.ai/threats/cve-2017-16100-dns-sync-command-injection-in-resolve-method  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2018-07-18. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2017-16100 · Severity: info · Published 2018-07-18

dns-sync is a Node.js library for performing DNS lookups. The resolve() method contains a command injection vulnerability that allows attackers to execute arbitrary system commands by passing specially crafted input to the DNS resolution function. An attacker who can control the input to resolve() can gain complete system access with the privileges of the application running dns-sync.

Technologies: [dns-sync (npm)](https://junglewise.ai/threats/technologies/dns-sync). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2017-16100 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2017-16100 being exploited in the wild.

**How severe is CVE-2017-16100?** Informational severity, published 18 July 2018.

**Which products and versions are affected?** dns-sync (npm) SEMVER:introduced=0,fixed=0.1.1.

**Is there a fix for CVE-2017-16100?** Yes. dns-sync (npm): upgrade to 0.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2017-16100 attacked?** It is attacked over the network or with local access, in a software library.

**Am I affected by CVE-2017-16100?** Check whether you run dns-sync (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- dns-sync (npm): upgrade to 0.1.1 or later

  ```sh
  npm install dns-sync@0.1.1
  ```


## Technical details

The vulnerability is a command injection flaw (CWE-94) in the resolve() method of dns-sync. The vulnerable code constructs a shell command by concatenating user input (hostname parameter) into a command string without proper escaping or sanitization, then executes it via shell.exec(). An attacker can inject shell metacharacters (e.g., $(id)) into the hostname parameter to break out of the intended command and execute arbitrary commands. Attack vector is local/network depending on application context; no authentication is required if the resolve() method is exposed to untrusted input. Versions prior to 0.1.1 are affected. A fix is available in version 0.1.1 and later.

## Affected products

- dns-sync All versions before 0.1.1

## Identifiers

- CVE-2017-16100
- GHSA-jcw8-r9xm-32c6

## Timeline

- 2014-11-10: disclosed
- 2018-07-18: advisory

## References

- [https://github.com/skoranga/node-dns-sync/issues/1](https://github.com/skoranga/node-dns-sync/issues/1)

## Related threats

- [dns-sync command injection](https://junglewise.ai/threats/dns-sync-command-injection-ec5bbb19)
- [node-dns-sync command injection](https://junglewise.ai/threats/cve-2020-11079-node-dns-sync-command-injection)
- [dns-sync command injection in resolve function](https://junglewise.ai/threats/dns-sync-command-injection-in-resolve-function-735f81d8)
- [dns-sync command injection via resolve function](https://junglewise.ai/threats/cve-2014-9682-dns-sync-command-injection-via-resolve-function)