GitHub Advisoryadvisory · npm
GHSA-h2p3-h48h-9jj7 PIDUsage Enables OS Command Injection
CRITICAL
Official page ↗
- Aliases
- CVE-2017-1000220
- Ecosystem
- npm
- Packages
- pidusage
- Severity
- Critical
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-78
- Reviewed
- 2024-04-22
Affected packages
• npm pidusage: < 1.1.5 → fixed in 1.1.5
Description
Overview
Affected versions of pidusage pass unsanitized input to `child_process.exec()`, resulting in arbitrary code execution in the `ps` method.
This package is vulnerable to this PoC on Darwin, SunOS, FreeBSD, and AIX.
Windows and Linux are not vulnerable.
Proof of Concept
```js
var pid = require('pidusage');
pid.stat('1 && /usr/local/bin/python');
```
Remediation
Update to version 1.1.5 or later.
Related
Alias · CVE (1)
- CVE-2017-1000220 soyuka/pidusage <=1.1.4 is vulnerable to command injection in the module resulting in arbitrary command execution vulnerability
Weakness · CWE (1)
- CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness