Executive brief
pidusage is a Node.js library that retrieves process resource usage statistics. Versions before 1.1.5 fail to sanitize user input passed to the stat() method, allowing attackers to execute arbitrary shell commands on systems running Darwin, SunOS, FreeBSD, and AIX. An attacker who can call the stat() function with crafted input can achieve remote code execution and gain full control over the affected system.
Technical details
The vulnerability is a command injection flaw (CWE-77) in the pidusage library's stat() method. The library passes unsanitized user-supplied input directly to child_process.exec(), which executes shell commands without proper escaping. An attacker can inject arbitrary shell metacharacters and commands into the PID argument. The vulnerability is present on Darwin, SunOS, FreeBSD, and AIX systems; Windows and Linux implementations are not vulnerable. The fix was released in version 1.1.5.
Affected products
- npm pidusage < 1.1.5
Timeline
- 2020-09-01: disclosed
- 2017: patched: Version 1.1.5 released with fix