Executive brief
psnode is a Node.js library for listing and terminating processes on Windows and macOS systems. The kill function fails to sanitize user input before executing system commands, allowing an attacker to inject arbitrary commands and achieve code execution on the host system.
Technical details
The vulnerability is a command injection (CWE-77) in the kill function of psnode, which uses Node.js child_process.exec() without sanitizing attacker-controlled input. An attacker who can supply a process ID or similar input to the kill function can break out of the intended command and execute arbitrary shell commands with the privileges of the Node.js process. The attack requires network or application-level access to call the vulnerable function, but no authentication or user interaction. The vulnerability affects all published versions of psnode. Patches are not documented in the advisory.
Affected products
- nrako psnode all versions
Timeline
- 2021-04-18: disclosed: NVD published
- 2021-05-06: advisory: GitHub advisory published