Executive brief
node-ps is a Node.js library used to query running processes on Unix-like systems. An attacker can inject arbitrary shell commands through the library's query function, gaining the ability to execute any command with the privileges of the Node.js process. This could allow an attacker to steal sensitive data, modify system files, or completely disable services using this library.
Technical details
The vulnerability is a classic OS command injection (CWE-78) in lib/index.js line 72, where the `_ps()` function concatenates user-supplied `args` directly into a shell command string passed to `childProcess.exec()`. The vulnerable code is: `cmd += ' ' + args.join(' ')`, followed by execution without sanitization. The attack vector is network-adjacent if the library is exposed through an application API, or local if called directly by untrusted code. No authentication is required—any code that can call the `lookup()` function with attacker-controlled `psargs` can exploit this. A proof-of-concept shows injecting `["& touch JHU #"]` to execute arbitrary commands. No patched version exists for node-ps; the package is unmaintained.
Affected products
- fortruce node-ps all versions up to and including 0.0.2
Timeline
- 2020-12-04: disclosed
- 2021-02-08: advisory
- 2021-03-19: other: Published to OSV database