Executive brief
@pendo324/get-process-by-name is a Node.js library used to retrieve process information by executable name. Due to improper input sanitization in the getProcessByName function, an attacker can execute arbitrary code when the library processes a specially crafted process name, potentially compromising applications that depend on this library.
Technical details
The vulnerability is a code injection flaw (CWE-94) in the getProcessByName function caused by insufficient sanitization of user-supplied input. The library fails to properly escape or validate the executable name parameter before using it in system commands, allowing an attacker to inject arbitrary code that will be executed with the privileges of the Node.js process. The attack vector is network-accessible if the vulnerable function is exposed through a web API or service that accepts external input. All versions of the package are affected, and no patched version is currently available.
Affected products
- @pendo324 get-process-by-name all versions
Timeline
- 2022-08-29: disclosed
- 2022-08-29: advisory