CVE-2022-30284

Deeper analysis

The vulnerability is a command injection flaw, tracked as CWE-88, in the python-libnmap package for Python through version 0.7.2. It affects the NmapProcess class when an application passes attacker-controlled data directly into Nmap arguments without validation, enabling remote command execution on the host running the Python code.

An unauthenticated remote attacker can exploit the issue by supplying crafted input over the network to any client application that uses python-libnmap in this manner. Successful exploitation grants the attacker the ability to execute arbitrary operating-system commands with the privileges of the vulnerable process, potentially leading to full system compromise.

Vendor statements in the package documentation and release notes emphasize that calling NmapProcess with untrusted network data is not an intended or documented use case, and they consider the high CVSS rating unrealistic. No official patches were issued; the project instead recommends that integrators perform their own argument validation before invoking the library.

EPSS scores for the CVE rose from low values after disclosure to a peak of 0.3147 in late 2025 before receding to the current 0.1421, indicating measurable post-disclosure interest in exploitation.