Overview

Affected versions of pidusage pass unsanitized input to child_process.exec(), resulting in arbitrary code execution in the ps method.

This package is vulnerable to this PoC on Darwin, SunOS, FreeBSD, and AIX.

Windows and Linux are not vulnerable.

Proof of Concept

var pid = require('pidusage');
pid.stat('1 && /usr/local/bin/python');

Remediation

Update to version 1.1.5 or later.

References

• https://nvd.nist.gov/vuln/detail/CVE-2017-1000220
• https://web.archive.org/web/20201208183910/https://www.npmjs.com/advisories/356