Description
This affects all versions of package kill-process-by-name. If (attacker-controlled) user input is given, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization in the index.js file.
Remediation
References
https://snyk.io/vuln/SNYK-JS-KILLPROCESSBYNAME-1078534
Related Vulnerabilities
CVE-2021-44550 Vulnerability in maven package edu.stanford.nlp:stanford-corenlp
CVE-2020-7622 Vulnerability in maven package io.jooby:jooby-netty
CVE-2020-28481 Vulnerability in maven package org.webjars.npm:socket.io
CVE-2020-17518 Vulnerability in maven package org.apache.flink:flink-runtime_2.11
CVE-2020-10758 Vulnerability in maven package org.keycloak:keycloak-wildfly-server-subsystem