Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWhmcTktcmZwdi1qOHI4

Command Injection in pidusage

Affected versions of pidusage pass unsanitized input to child_process.exec(), resulting in arbitrary code execution in the ps method.

This package is vulnerable to this PoC on Darwin, SunOS, FreeBSD, and AIX.

Windows and Linux are not vulnerable.

Proof of Concept

var pid = require('pidusage');
pid.stat('1 && /usr/local/bin/python');

Recommendation

Update to version 1.1.5 or later.

Permalink: https://github.com/advisories/GHSA-hfq9-rfpv-j8r8
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWhmcTktcmZwdi1qOHI4
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: over 3 years ago
Updated: over 1 year ago

Identifiers: GHSA-hfq9-rfpv-j8r8, CVE-2017-16034
References:

• https://www.npmjs.com/advisories/356
• https://nvd.nist.gov/vuln/detail/CVE-2017-16034
• https://github.com/advisories/GHSA-hfq9-rfpv-j8r8

Blast Radius: 0.0

Affected Packages