CVE-2021-23355

This affects all versions of package ps-kill. If (attacker-controlled) user input is given to the kill function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization in the index.js file. PoC (provided by reporter): var ps_kill = require('ps-kill'); ps_kill.kill('$(touch success)',function(){});

Link	Resource
https://snyk.io/vuln/SNYK-JS-PSKILL-1078529	Exploit Third Party Advisory

Configuration 1

cpe:2.3:a:ps-kill_project:ps-kill:*:*:*:*:*:node.js:*:*

---

Published : 2021-03-15 05:15

Updated : 2022-06-28 02:11

---

NVD link : CVE-2021-23355

Mitre link : CVE-2021-23355

No products.

CWE-78