GitHub Advisoryadvisory · npm

GHSA-mm4f-47ch-f7hx Arbitrary code execution in kill-by-port

MEDIUM Published 2021-04-13 Modified 2022-07-05 Official page ↗
Aliases
CVE-2021-23363
Ecosystem
npm
Packages
kill-by-port
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-77
Reviewed
2021-03-31

Affected packages

• npm kill-by-port: < 0.0.2 → fixed in 0.0.2

Description

This affects the package kill-by-port before 0.0.2. If (attacker-controlled) user input is given to the killByPort function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.

Related

Alias · CVE (1)

  • CVE-2021-23363 This affects the package kill-by-port before 0.0.2. vulnerability

Weakness · CWE (1)

  • CWE-77 Improper Neutralization of Special Elements used in a Command weakness

References