Daily security quiz #6

Question for 2026-11-06. Read the code and pick the most serious security vulnerability.

This administrative feature uses ping to check whether a server is up (Linux server). What is the most serious vulnerability?

1const { exec } = require('child_process');
2 
3app.get('/admin/ping', (req, res) => {
4  exec(`ping -c 1 ${req.query.host}`, (err, stdout) => {
5    res.type('text/plain').send(stdout);
6  });
7});

1. ADisplaying the ping output as is exposes the server's IP address
2. BAn attacker can put ; or && in host to execute arbitrary commands (command injection)
3. Cexec is asynchronous, so responses are slow
4. DNot handling errors (err) shuts down the server