You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
ps Enables OS Command Injection
Critical severity
GitHub Reviewed
Published
Sep 17, 2018
to the GitHub Advisory Database
•
Updated Sep 11, 2023
Versions of ps before 1.0.0 are vulnerable to command injection.
Proof of concept:
varps=require('ps');ps.lookup({pid: "$(touch success.txt)"},function(err,proc){// this method is vulnerable to command injectionif(err){throwerr;}if(proc){console.log(proc);// Process name, something like "node" or "bash"}else{console.log('No such process');}});// Result: The file success.txt will exist on the filesystem if the touch command was executed
Versions of
ps
before 1.0.0 are vulnerable to command injection.Proof of concept:
Recommendation
Update to version 1.0.0 or later.
References