CVE-2019-15599

The vulnerability CVE-2019-15599 affects the Windows component of the Node package tree-kill, where the input to the kill() function is not properly sanitized and is concatenated into an exec() call. This leads to remote code execution if an attacker provides controlled input. Public advisories c...

PT-2019-14302

Name of the Vulnerable Software and Affected Versions treekill affected versions not specified tree-kill affected versions not specified Description A Code Injection issue exists in treekill and tree-kill on Windows, allowing remote code execution when an attacker controls the input into the...

PT-2019-14303

Name of the Vulnerable Software and Affected Versions tree-kill versions prior to 1.2.2 Description A Code Injection exists in tree-kill on Windows, allowing remote code execution when an attacker controls the input into the command. The issue arises from the failure to sanitize values passed to...

CVE-2019-15599: Improper Control of Generation of Code

A Code Injection exists in tree-kill on Windows which allows a remote code execution when an attacker is able to control the input into the command...

Command Injection

Overview Versions of tree-kill prior to 1.2.2 are vulnerable to Command Injection. The package fails to sanitize values passed to the kill function. If this value is user-controlled it may allow attackers to run arbitrary commands in the server. The issue only affects Windows systems...

Node.js third-party modules: [tree-kill] RCE via insecure command concatenation (only Windows)

I would like to report a RCE issue in the tree-kill module. It allows to execute arbitrary commands remotely inside the victim's PC Module module name: tree-kill version: 1.2.1 npm page: https://www.npmjs.com/package/tree-kill Module Description Kill all processes in the process tree, including t...