CVE-2017-1000219: Command Execution in windows-cpu
Summary
CVE-2017-1000219: Command Execution in windows-cpu. Affects windows-cpu versions < 0.1.5. Fixed in 0.1.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The windows-cpu package is an npm package that provides functionality for monitoring CPU usage on Windows systems. It allows users to retrieve information about CPU load and usage. The package is commonly used in Windows-based applications to monitor system performance. However, versions prior to 0.1.5 of windows-cpu are vulnerable to command execution, which can lead to remote code execution.
Vulnerability Detail
The vulnerability in windows-cpu version before 0.1.5 arises from the insecure handling of user input. Specifically, the findLoad method does not properly sanitize the first argument, allowing arbitrary code execution. An attacker can exploit this vulnerability by passing malicious code as the first argument to the findLoad method. This can result in the execution of arbitrary commands on the target system, potentially leading to remote code execution. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
How To Fix
Latest published version: 1.1.0 as of 22 Oct 2026
npm install windows-cpu@1.1.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.1.5
This is the first release that contains the fix.
npm install windows-cpu@0.1.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid passing user-controlled input to the findLoad method. By ensuring that only trusted and sanitized input is used as the argument, the risk of command execution can be mitigated. Here is an example of how to use the findLoad method with sanitized input:
var win = require('windows-cpu');
var sanitizedInput = sanitizeInput(userInput); // Implement your own input sanitization
win.findLoad(sanitizedInput);
Conclusion
The windows-cpu package prior to version 0.1.5 is vulnerable to command execution, which can lead to remote code execution. It is crucial to update to version 0.1.5 or later to mitigate the risk. By updating the package, you ensure that user input is properly sanitized and prevent potential unauthorized access or compromise of your system. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for windows-cpu →
FAQ
The vulnerability allows an attacker to execute arbitrary commands on the target system, potentially leading to remote code execution. This can result in unauthorized access, data theft, or further compromise of the system.
While a proof of concept is provided in the vulnerability details, there is no known public exploit available at this time. However, it is important to address this vulnerability promptly to prevent potential exploitation.
No, only versions prior to 0.1.5 of windows-cpu are affected by this vulnerability. It is recommended to update to version 0.1.5 or later to mitigate the risk.
Yes, the vulnerability has been fixed in version 0.1.5 of windows-cpu. It is crucial to update to this version or any subsequent versions to ensure the security of your application.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the package-lock.json file.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
