CVE-2019-15609: Command Injection in kill-port-process
Summary
CVE-2019-15609: OS Command Injection and Command Injection in kill-port-process. Affects kill-port-process versions < 2.2.1. Fixed in 2.2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The kill-port-process package is an npm package used for killing processes running on specific ports. It provides a convenient way to terminate processes that are occupying certain ports. However, versions prior to 2.2.0 are vulnerable to a Command Injection vulnerability.
Vulnerability Detail
The Command Injection vulnerability in kill-port-process allows an attacker to execute arbitrary commands on the host system by injecting malicious input. This can lead to unauthorized access, data breaches, or even complete compromise of the affected system. The vulnerability is rated as HIGH severity with a CVSS score of 9.8.
How To Fix
Minimum fixed version
2.2.1
This is the first release that contains the fix.
npm install kill-port-process@2.2.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the fixed version of the kill-port-process package to mitigate the risk of exploitation.
Conclusion
The Command Injection vulnerability in the kill-port-process package can have severe consequences, including unauthorized access and data breaches. It is crucial to update to version 2.2.1 or later to mitigate the risk. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for kill-port-process →
FAQ
This vulnerability allows an attacker to execute arbitrary commands on the host system, potentially leading to unauthorized access, data breaches, or complete compromise of the affected system.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it for any open-source vulnerabilities, including this one.
Yes, upgrading to version 2.2.1 or later of the kill-port-process package fixes this vulnerability. Make sure to update your package by running 'npm install kill-port-process@2.2.1'.
There are no known workarounds for this vulnerability. It is essential to update to the fixed version of the kill-port-process package.
You can find more information about this vulnerability in the GitHub Advisory Database at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-xp4x-j9vh-c3wf/GHSA-xp4x-j9vh-c3wf.json
