CVE-2017-1000220: PIDUsage Enables OS Command Injection in pidusage
Summary
CVE-2017-1000220: PIDUsage Enables OS Command Injection. Affects pidusage versions < 1.1.5. Fixed in 1.1.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pidusage is an npm package that provides information about the resource usage of a process. It allows users to retrieve statistics such as CPU usage, memory usage, and more. However, versions prior to 1.1.5 are vulnerable to OS command injection.
Vulnerability Detail
The vulnerability in pidusage arises from passing unsanitized input to the child_process.exec() function, which can lead to arbitrary code execution in the ps method. This vulnerability affects Darwin, SunOS, FreeBSD, and AIX platforms. Windows and Linux are not vulnerable. An attacker can exploit this vulnerability by injecting malicious commands, potentially leading to unauthorized access, data leakage, or further compromise of the system.
How To Fix
Latest published version: 4.1.0 as of 23 Oct 2026
npm install pidusage@4.1.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.1.5
This is the first release that contains the fix.
npm install pidusage@1.1.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability.
Conclusion
The vulnerability in pidusage allows for OS command injection, which can lead to arbitrary code execution. It is crucial to update to version 1.1.5 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pidusage →
FAQ
pidusage is an npm package that provides information about the resource usage of a process.
Versions prior to 1.1.5 are affected by this vulnerability.
Darwin, SunOS, FreeBSD, and AIX platforms are vulnerable. Windows and Linux are not affected.
This vulnerability can lead to arbitrary code execution, potentially resulting in unauthorized access, data leakage, or further compromise of the system.
Yes, updating pidusage to version 1.1.5 or later will fix this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for pidusage.
