GitHub Advisoryadvisory · npm

GHSA-884p-74jh-xrg2 Command Injection in tree-kill

HIGH Published 2020-09-04 Modified 2023-11-08 Official page ↗
Aliases
CVE-2019-15599
Ecosystem
npm
Packages
tree-kill
Severity
High
Weaknesses
CWE-94
Reviewed
2020-08-31

Affected packages

• npm tree-kill: < 1.2.2 → fixed in 1.2.2

Description

Versions of `tree-kill` prior to 1.2.2 are vulnerable to Command Injection. The package fails to sanitize values passed to the `kill` function. If this value is user-controlled it may allow attackers to run arbitrary commands in the server. The issue only affects Windows systems. Recommendation Upgrade to version 1.2.2 or later.

Related

Alias · CVE (1)

  • CVE-2019-15599 A Code Injection exists in tree-kill on Windows which allows a remote code execution when an attacker is able to control the input into the… vulnerability

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References