GitHub Advisoryadvisory · npm

GHSA-5wqj-f379-6jh4 Command injection in kill-process-on-port

HIGH Published 2021-03-19 Modified 2021-03-16 Official page ↗

Aliases: CVE-2020-28426
Ecosystem: npm
Packages: kill-process-on-port
Severity: High
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weaknesses: CWE-77
Reviewed: 2021-03-16

Affected packages

• npm kill-process-on-port: <= 1.0.2 (no fix yet)

Description

All versions of package kill-process-on-port are vulnerable to Command Injection via a.getProcessPortId.

Related

Alias · CVE (1)

CVE-2020-28426 All versions of package kill-process-on-port are vulnerable to Command Injection via a.getProcessPortId. vulnerability

Weakness · CWE (1)

CWE-77 Improper Neutralization of Special Elements used in a Command weakness

References