GitHub Advisoryadvisory · npm
GHSA-hfq9-rfpv-j8r8 Command Injection in pidusage
CRITICAL
Official page ↗
- Aliases
- CVE-2017-16034
- Ecosystem
- npm
- Packages
- pidusage
- Severity
- Critical
- Weaknesses
- CWE-77
- Reviewed
- 2020-08-31
Affected packages
• npm pidusage: < 1.1.5 → fixed in 1.1.5
Description
Affected versions of `pidusage` pass unsanitized input to `child_process.exec()`, resulting in arbitrary code execution in the `ps` method.
This package is vulnerable to this PoC on Darwin, SunOS, FreeBSD, and AIX.
Windows and Linux are not vulnerable.
Proof of Concept
```
var pid = require('pidusage');
pid.stat('1 && /usr/local/bin/python');
```
Recommendation
Update to version 1.1.5 or later.
Related
Alias · not in database (1)
Weakness · CWE (1)
- CWE-77 Improper Neutralization of Special Elements used in a Command weakness