Description
If an attacker can control the port, which in itself is a very sensitive value, they can inject arbitrary OS commands due to the usage of the exec function in a third-party module kill-port < 1.3.2.
Remediation
References
https://hackerone.com/reports/389561
Related Vulnerabilities
CVE-2021-3666 Vulnerability in npm package body-parser-xml
CVE-2021-46365 Vulnerability in maven package info.magnolia:magnolia-core
CVE-2021-25646 Vulnerability in maven package org.apache.druid:druid-core
CVE-2018-1000863 Vulnerability in maven package org.jenkins-ci.main:jenkins-core
CVE-2023-39106 Vulnerability in maven package com.alibaba.nacos:nacos-spring-context