Skip to content
OpenAdvisories
Critical CVE-2017-16034 GHSA-hfq9-rfpv-j8r8

Command Injection in pidusage

Published Sep 1, 2020 · Updated Nov 8, 2023 · Assigned by GHSA

Description

Affected versions of `pidusage` pass unsanitized input to `child_process.exec()`, resulting in arbitrary code execution in the `ps` method.

This package is vulnerable to this PoC on Darwin, SunOS, FreeBSD, and AIX.

Windows and Linux are not vulnerable.

## Proof of Concept
```
var pid = require('pidusage');
pid.stat('1 && /usr/local/bin/python');
```

## Recommendation

Update to version 1.1.5 or later.

Affected packages

EcosystemPackageAffectedFixedRecord
npm pidusage < 1.1.5 1.1.5 GHSA-hfq9-rfpv-j8r8

References