GHSA-pmv6-gf98-p3r5HighCVSS 8.1

Command Injection in kill-port

Published
March 25, 2019
Last Modified
September 8, 2023

🔗 CVE IDs covered (1)

CVE-2019-5414 →

📋 Description

Versions of kill-port prior to 1.3.2 are vulnerable to Command Injection. The package does not validate user input on the kill function. This may allow attackers to run arbitrary commands in the system if user input (such as the port number) is passed directly to the function.

Recommendation

Upgrade to version 1.3.2 or later.

🎯 Affected products1

  • npm/kill-port:< 1.3.2

🔗 References (4)