GitHub Advisoryadvisory · npm

GHSA-xfxf-qw26-hr33 Arbitrary command execution in roar-pidusage

MEDIUM Published 2021-05-06 Modified 2022-07-05 Official page ↗
Aliases
CVE-2021-23380
Ecosystem
npm
Packages
roar-pidusage
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-77
Reviewed
2021-04-19

Affected packages

• npm roar-pidusage: <= 1.1.7 (no fix yet)

Description

This affects all current versions of package roar-pidusage. If attacker-controlled user input is given to the stat function of this package on certain operating systems, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.

Related

Alias · CVE (1)

  • CVE-2021-23380 This affects all versions of package roar-pidusage. vulnerability

Weakness · CWE (1)

  • CWE-77 Improper Neutralization of Special Elements used in a Command weakness

References