Command Injection in node-windows

严重 9.8CVE-2021-45459 · GHSA-53xv-c2hx-5w6q · Published 22/12/2021 · updated 17/06/2026

要点

CVE-2021-45459 是影响 node-windows (node-windows project), node-windows 的严重 (CVSS 9.8)漏洞。
未来 30 天内被利用的概率（EPSS）：4.1%，高于 90.7% 的漏洞。
修复：升级到 1.0.0-beta.6 或更高版本。

Package	Affected versions	Patched versions
node-windows node-windows_project	`= 1.0.0≤ 0.1.14`	No fix yet
node-windows npm	`< 1.0.0-beta.6`	`1.0.0-beta.6`

lib/cmd.js in the node-windows package before 1.0.0-beta.6 for Node.js allows command injection via the PID parameter.

NVD description

lib/cmd.js in the node-windows package before 1.0.0-beta.6 for Node.js allows command injection via the PID parameter.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.