Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Arbitrary Command Injection
Vulnerability Description
This affects all versions of package port-killer. If (attacker-controlled) user input is given, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization. Running this PoC will cause the command touch success to be executed, leading to the creation of a file called success.
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability Type
N/A
Vulnerability Title
Npm port-killer 操作系统命令注入漏洞
Vulnerability Description
Npm port-killer是美国 （Npm）公司的一个应用软件。提供一个终止在给定端口上运行的进程功能。 Npm port-killer 存在操作系统命令注入漏洞，该漏洞使用子进程执行函数时没有输入检查。
CVSS Information
N/A
Vulnerability Type
N/A