CVE-2017-1000220 - soyuka/pidusage <=1.1.4 is vulnerable to command injection in the module resulting in arbitrary command execution

CRITICAL

soyuka/pidusage <=1.1.4 is vulnerable to command injection in the module resulting in arbitrary command execution

Published Nov 17, 2017

9.8

CRITICAL

CVSS 3.0

EPSS 5.06%

soyuka/pidusage <=1.1.4 is vulnerable to command injection in the module resulting in arbitrary command execution

Ecosystem	Package	Introduced	Fixed
npm	pidusage	0	1.1.5

No remediation recorded yet.

Weaknesses (1)

CWE-78

OS Command Injection

Link	Providers	Tags
https://github.com/advisories/GHSA-h2p3-h48h-9jj7		Advisory
https://github.com/soyuka/pidusage/commit/b70eca15f7ca7f1b82a15f8a5d4bb48737f5a89d
https://nodesecurity.io/advisories/356		x_refsource_MISCExploitMitigationThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2017-1000220
https://web.archive.org/web/20201208183910/https://www.npmjs.com/advisories/356