HIGH

GHSA-884p-74jh-xrg2

Command Injection in tree-kill

Quick fix

GHSA-884p-74jh-xrg2 — tree-kill: upgrade to the fixed version with the command below.

npm install tree-kill@1.2.2

Details

Versions of `tree-kill` prior to 1.2.2 are vulnerable to Command Injection. The package fails to sanitize values passed to the `kill` function. If this value is user-controlled it may allow attackers to run arbitrary commands in the server. The issue only affects Windows systems.

## Recommendation

Upgrade to version 1.2.2 or later.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/tree-kill

Introduced in: 0Fixed in: 1.2.2

Fixnpm install tree-kill@1.2.2

References

https://nvd.nist.gov/vuln/detail/CVE-2019-15599[ADVISORY]
https://github.com/pkrumins/node-tree-kill/commit/deee138a8cbc918463d8af5ce8c2bec33c3fd164[WEB]
https://hackerone.com/reports/701183[WEB]
https://github.com/pkrumins/node-tree-kill[PACKAGE]
https://github.com/pkrumins/node-tree-kill/releases/tag/v1.2.2[WEB]