What is GHSA-884p-74jh-xrg2?

GHSA-884p-74jh-xrg2 is a security advisory published by GitHub Security Advisories with High severity. Command Injection in tree-kill

Which CVE IDs does GHSA-884p-74jh-xrg2 cover?

GHSA-884p-74jh-xrg2 covers the following CVE IDs: CVE-2019-15599. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-884p-74jh-xrg2?

GHSA-884p-74jh-xrg2 affects 1 product, including: npm/tree-kill:\u003c 1.2.2.

GHSA-884p-74jh-xrg2High

Command Injection in tree-kill

Vendor

GitHub Security Advisories

Published

September 4, 2020

Last Modified

November 29, 2023

🔗 CVE IDs covered (1)

CVE-2019-15599 →

📋 Description

Versions of tree-kill prior to 1.2.2 are vulnerable to Command Injection. The package fails to sanitize values passed to the kill function. If this value is user-controlled it may allow attackers to run arbitrary commands in the server. The issue only affects Windows systems.

Recommendation

Upgrade to version 1.2.2 or later.

🎯 Affected products1

npm/tree-kill:< 1.2.2

🔗 References (5)

https://hackerone.com/reports/701183
https://github.com/pkrumins/node-tree-kill/commit/deee138a8cbc918463d8af5ce8c2bec33c3fd164
https://nvd.nist.gov/vuln/detail/CVE-2019-15599
https://github.com/pkrumins/node-tree-kill/releases/tag/v1.2.2
https://github.com/advisories/GHSA-884p-74jh-xrg2