GitHub Advisoryadvisory · npm

GHSA-pmv6-gf98-p3r5 Command Injection in kill-port

HIGH Published 2019-03-25 Modified 2023-09-08 Official page ↗
Aliases
CVE-2019-5414
Ecosystem
npm
Packages
kill-port
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-77
Reviewed
2020-06-16

Affected packages

• npm kill-port: < 1.3.2 → fixed in 1.3.2

Description

Versions of `kill-port` prior to 1.3.2 are vulnerable to Command Injection. The package does not validate user input on the `kill` function. This may allow attackers to run arbitrary commands in the system if user input (such as the port number) is passed directly to the function. Recommendation Upgrade to version 1.3.2 or later.

Related

Alias · CVE (1)

  • CVE-2019-5414 If an attacker can control the port, which in itself is a very sensitive value, they can inject arbitrary OS commands due to the usage of… vulnerability

Weakness · CWE (1)

  • CWE-77 Improper Neutralization of Special Elements used in a Command weakness

References