Description

A command Injection in ps package versions <1.0.0 for Node.js allowed arbitrary commands to be executed when attacker controls the PID.

Remediation

References

https://hackerone.com/reports/390848

Related Vulnerabilities

CVE-2018-1999024 Vulnerability in maven package org.webjars.npm:mathjax

CVE-2022-21667 Vulnerability in npm package @soketi/soketi

CVE-2019-10744 Vulnerability in npm package @sailshq/lodash

CVE-2019-16771 Vulnerability in maven package com.linecorp.armeria:armeria

CVE-2020-7615 Vulnerability in npm package fsa

Severity

Critical

Classification

CWE-78 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Third Party Advisory