Executive brief
The treekill npm package is a utility used to forcibly terminate processes in Node.js applications, primarily on Windows systems. A vulnerability allows attackers to inject and execute arbitrary system commands if they can control the process ID or signal value passed to the kill function. This could lead to complete system compromise, including data theft, malware installation, or service disruption, depending on the privileges of the affected application.
Technical details
The treekill package contains a command injection vulnerability (CWE-77) in its kill function implementation. The package constructs and executes shell commands using unsanitized user input without proper escaping or parameterization. The vulnerability affects all versions across Windows platforms. Attack preconditions require that an application passes untrusted input (such as a user-supplied process ID) directly to treekill's kill function. An attacker can inject shell metacharacters to break out of the intended command and execute arbitrary system commands. No patch has been released; users are advised to migrate to alternative process termination libraries.
Affected products
- npm treekill all versions
Timeline
- 2020-09-04: disclosed: Vulnerability published to GitHub Advisory Database