CVE-2019-15598: Command Injection in tree-kill
Summary
CVE-2019-15598: Treekill Enables OS Command Injection. Affects tree-kill versions < 1.2.2. Fixed in 1.2.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The package under scrutiny is tree-kill, an npm package used for terminating child processes in a cross-platform manner. It provides a function called treekill that allows users to kill processes and their descendants. The vulnerability in question enables OS command injection on Windows systems when an attacker can control the input into the command. This can lead to remote code execution.
Vulnerability Detail
The vulnerability (CVE-2019-15598) in tree-kill allows an attacker to execute arbitrary commands on a Windows system by injecting malicious code into the command input. By exploiting this vulnerability, an attacker can gain unauthorized access and perform various malicious activities. The vulnerability has a CVSS score of 9.8, indicating its critical severity.
How To Fix
Latest published version: 1.2.2 as of 23 Oct 2026
npm install tree-kill@1.2.2The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the package is not immediately feasible, users can implement input validation and sanitization to mitigate the risk of command injection. It is crucial to ensure that user-controlled input is properly validated and sanitized before being used in commands.
Conclusion
In conclusion, the tree-kill package is vulnerable to command injection on Windows systems. It is crucial to update the package to version 1.2.2 or later to mitigate this vulnerability. If immediate update is not possible, implementing input validation and sanitization can help reduce the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tree-kill →
FAQ
This vulnerability allows an attacker to execute arbitrary commands on a Windows system, potentially leading to remote code execution and unauthorized access.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
The CVSS score of this vulnerability is 9.8, indicating its critical severity.
Yes, implementing input validation and sanitization can help mitigate the risk of command injection while an update to the tree-kill package is being applied.
You can update the tree-kill package to the latest version (1.2.2 or later) by running the command 'npm install tree-kill@latest'.
References
Related vulnerabilities
Recent vulnerabilities recorded for tree-kill.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
