~ / search / GHSA-pmv6-gf98-p3r5

GHSA-pmv6-gf98-p3r5

Command Injection in kill-port

Source: GitHub Advisory Database (reviewed) High CVE-2019-5414

Packages

EcosystemPackageAffectedFixed in
npm kill-port < 1.3.2 1.3.2

Details

As written in the advisory (Markdown source, shown as plain text).

Versions of `kill-port` prior to 1.3.2 are vulnerable to Command Injection. The package does not validate user input on the `kill` function. This may allow attackers to run arbitrary commands in the system if user input (such as the port number) is passed directly to the function. ## Recommendation Upgrade to version 1.3.2 or later.

References

External links from the advisory. They lead to third-party sites.