Homepage
About Snyk

windows-cpu@0.1.3 vulnerabilities

CPU monitoring utilities for Node.js apps on Windows.

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the windows-cpu package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • H
Arbitrary Command Execution

windows-cpu is a CPU monitoring utility for windows.

Affected versions of this package are vulnerable to Arbitrary Command Execution via the findLoad method, which passes a user-inputed string to the shell without validation.

Proof of Concept: This code will open the built-in calculator program.

var win = require('windows-cpu');
wind.findLoad('foo & calc.exe');

How to fix Arbitrary Command Execution?

There is no fix version for windows-cpu.

*
Go back to all versions of this package