Advisory Database
  • Advisories
  • Dependency Scanning
  1. npm
  2. ›
  3. pidusage
  4. ›
  5. GMS-2017-137

GMS-2017-137: Command Injection

June 5, 2017

The pidusage module passes unsanitized input to child_process.exec, resulting in command injection in the ps method, as the pid is never cast to an integer as the comment expects. This module is vulnerable to this PoC on Darwin, SunOS, FreeBSD, and AIX. Windows and Linux are not vulnerable.

Code Behaviors & Features

Detect and mitigate GMS-2017-137 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions up to 1.1.4

Fixed versions

  • 1.1.5

Solution

Update to version 1.1.5 or later. Otherwise, before passing any untrusted data to the stat function, ensure that the data is sanitized using a proper shell escaping library. Note that Windows and Linux are not vulnerable.

Source file

npm/pidusage/GMS-2017-137.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Wed, 14 May 2025 12:16:03 +0000.