Nostromo 1.9.6 - Remote Code Execution

Nash N Sulthan
Published on
16 Jun 2021

An unauthenticated attacker can force server points to a shell file like ‘/bin/sh’ and execute arbitrary commands due to the failure in verifying the URL which leads to path traversal to any file that exists in the system. Nostromo’s versions such as 1.9.6 fail to verify this URL and the developer’s website (, was also vulnerable.


A successful attack will result in gaining sensitive details such as application code and data, operating system files, etc.

Mitigation / Precaution

  • We recommend you to apply the patch released on the developer’s official website (
Automated human-like penetration testing for your web apps & APIs
Teams using Beagle Security are set up in minutes, embrace release-based CI/CD security testing and save up to 65% with timely remediation of vulnerabilities. Sign up for a free account to see what it can do for you.

Written by
Nash N Sulthan
Nash N Sulthan
Cyber Security Lead Engineer
Find website security issues in a flash
Improve your website's security posture with proactive vulnerability detection.
Free website security assessment