Description

This affects all versions of package killing. If attacker-controlled user input is given, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.

Remediation

References

https://github.com/xudafeng/killing/blob/672ed164ccdd10c0a8fb93c5c6d2456f1dfab781/lib/killing.js%23L62

https://snyk.io/vuln/SNYK-JS-KILLING-1078532

Related Vulnerabilities

CVE-2020-7746 Vulnerability in maven package org.webjars.bowergithub.chartjs:chart.js

CVE-2022-43420 Vulnerability in maven package org.jenkins-ci.plugins:contrast-continuous-application-security

CVE-2019-17554 Vulnerability in maven package org.apache.olingo:odata-server-api

CVE-2021-21290 Vulnerability in maven package io.netty:netty-transport-native-epoll

CVE-2021-23416 Vulnerability in npm package curly-bracket-parser

Severity

Critical

Classification

CWE-78 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Broken Link Exploit Third Party Advisory