~ / search / GHSA-vm67-7vmg-66vm

GHSA-vm67-7vmg-66vm

Arbitrary Command Injection in portprocesses

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-23348

Packages

EcosystemPackageAffectedFixed in
npm portprocesses < 1.0.5 1.0.5

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact An Arbitrary Command Injection vulnerability was reported in `portprocesses` impacting versions <= 1.0.4. ### Example (Proof of Concept) The following example demonstrates the vulnerability and will run `touch success` therefore creating a file named `success`. ```js const portprocesses = require("portprocesses"); portprocesses.killProcess("$(touch success)"); ```

References

External links from the advisory. They lead to third-party sites.