Command Injection in tree-kill

CRITICO 9.8CVE-2019-15599 · GHSA-884p-74jh-xrg2 · Published 18/12/2019 · updated 17/06/2026

In breve

CVE-2019-15599 è una vulnerabilità CRITICO (CVSS 9.8) che riguarda tree-kill (tree-kill project), tree-kill.
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 2.7%, superiore al 86.2% delle vulnerabilità.
Correzione: aggiornare a 1.2.2 o successiva.

Package	Affected versions	Patched versions
tree-kill tree-kill_project	`= 1.2.1`	No fix yet
tree-kill npm	`< 1.2.2`	`1.2.2`

Description

Versions of tree-kill prior to 1.2.2 are vulnerable to Command Injection. The package fails to sanitize values passed to the kill function. If this value is user-controlled it may allow attackers to run arbitrary commands in the server. The issue only affects Windows systems.

Recommendation

Upgrade to version 1.2.2 or later.

NVD description

A Code Injection exists in tree-kill on Windows which allows a remote code execution when an attacker is able to control the input into the command.

References

nvd.nist.gov/vuln/detail/CVE-2019-15599 · ADVISORY
pkrumins/node-tree-kill commit deee138 · WEB
hackerone.com/reports/701183 · WEB
pkrumins/node-tree-kill · PACKAGE
pkrumins/node-tree-kill release v1.2.2 · WEB

Altre vulnerabilità di tree-kill

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free