Arbitrary Code Execution

2021-04-1900:27:42

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

arbitrary code execution

vulnerable software

child process exec

EPSS

0.005

Percentile

76.1%

JSON

killing is vulnerable to arbitrary code execution. The vulnerability exists as it does not sanitize the argument that is used in child_process.exec, allowing users to use the function outside of its intended behaviour, which was to kill processes.

References

github.com/xudafeng/killing/blob/672ed164ccdd10c0a8fb93c5c6d2456f1dfab781/lib/killing.js%23L62

github.com/xudafeng/killing/commit/ab4a5e7ebc8cee538afb35ee1b2bd59cfdb06e6d#diff-f98634412b509bc53dc9a2d8442fd1fe285766c2ee9f8bf3382f4fb6711df45fR36

EPSS

0.005

Percentile

76.1%

JSON

Related for VERACODE:30017