Command Injection in tree-kill
Summary
CVE-2019-15599: Command Injection in tree-kill. Affects tree-kill versions < 1.2.2. Fixed in 1.2.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The tree-kill package is an npm package used for terminating processes in a cross-platform manner. It provides a function called tree-kill that allows users to kill processes by their process ID (PID). This package is commonly used in Node.js applications to manage and control child processes. However, versions prior to 1.2.2 are vulnerable to Command Injection on Windows systems.
Vulnerability Detail
The vulnerability in tree-kill arises from a failure to properly sanitize user-controlled values passed to the kill function. This allows an attacker to inject arbitrary commands into the server. If an attacker successfully exploits this vulnerability, they can execute unauthorized commands with the privileges of the user running the server. It is important to note that this vulnerability only affects Windows systems.
How To Fix
Minimum fixed version
1.2.2
This is the first release that contains the fix.
npm install tree-kill@1.2.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, upgrading to the fixed version is the recommended solution.
Conclusion
The tree-kill package prior to version 1.2.2 is vulnerable to Command Injection on Windows systems. To mitigate this vulnerability, it is recommended to upgrade to version 1.2.2 or later. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tree-kill →
FAQ
If exploited, this vulnerability allows an attacker to execute arbitrary commands on the server with the privileges of the user running the server.
This vulnerability only affects Windows systems.
There are no known instances of this vulnerability being exploited at the time of this advisory.
Yes, upgrading to version 1.2.2 or later of the tree-kill package fixes this vulnerability.
The only mitigation for this vulnerability is to upgrade to the fixed version of the tree-kill package.
Related vulnerabilities
Recent vulnerabilities recorded for tree-kill.
