Arbitrary Command Injection Affecting ps package, versions <1.0.0
Threat Intelligence
EPSS
0.32% (72nd
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-PS-72307
- published 9 Sep 2018
- disclosed 7 Sep 2018
- credit Cristian-Alexandru Staicu
Introduced: 7 Sep 2018
CVE-2018-16460 Open this link in a new tabHow to fix?
Upgrade ps to version 1.0.0 or higher.
Overview
ps is A Node.js module for looking up running processes.
Affected versions of this package are vulnerable to Arbitrary Command Injection. An attacker could inject arbitrary OS commands instead of PID numbers.
CVSS Scores
version 3.1