GHSA-884p-74jh-xrg2

Command Injection in tree-kill

Source: GitHub Advisory Database (reviewed) High CVE-2019-15599

Packages

Ecosystem	Package	Affected	Fixed in
npm	tree-kill	< 1.2.2	1.2.2

Details

As written in the advisory (Markdown source, shown as plain text).

Versions of `tree-kill` prior to 1.2.2 are vulnerable to Command Injection. The package fails to sanitize values passed to the `kill` function. If this value is user-controlled it may allow attackers to run arbitrary commands in the server. The issue only affects Windows systems. ## Recommendation Upgrade to version 1.2.2 or later.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2019-15599 advisory
https://github.com/pkrumins/node-tree-kill/commit/deee138a8cbc918463d8af5ce8c2bec33c3fd164 web
https://hackerone.com/reports/701183 web
https://github.com/pkrumins/node-tree-kill package
https://github.com/pkrumins/node-tree-kill/releases/tag/v1.2.2 web