Command Injection in kill-port

ALTO 8.1CVE-2019-5414 · GHSA-pmv6-gf98-p3r5 · Published 21/03/2019 · updated 17/06/2026

En resumen

CVE-2019-5414 es una vulnerabilidad ALTO (CVSS 8.1) que afecta a kill-port (kill-port project), kill-port.
Probabilidad de explotación en los próximos 30 días (EPSS): 1.9%, mayor que el 79.7% de las vulnerabilidades.
Solución: actualizar a 1.3.2 o posterior.

Package	Affected versions	Patched versions
kill-port kill-port_project	`< 1.3.2`	`1.3.2`
kill-port npm	`< 1.3.2`	`1.3.2`

Description

Versions of kill-port prior to 1.3.2 are vulnerable to Command Injection. The package does not validate user input on the kill function. This may allow attackers to run arbitrary commands in the system if user input (such as the port number) is passed directly to the function.

Recommendation

Upgrade to version 1.3.2 or later.

NVD description

If an attacker can control the port, which in itself is a very sensitive value, they can inject arbitrary OS commands due to the usage of the exec function in a third-party module kill-port < 1.3.2.

References

nvd.nist.gov/vuln/detail/CVE-2019-5414 · ADVISORY
hackerone.com/reports/389561 · WEB
GitHub Advisory GHSA-pmv6-gf98-p3r5 · ADVISORY
npmjs.com/advisories/966 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free