This affects the package portprocesses before 1.0.5. If (attacker-controlled) user input is given to the killProcess function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.

Affected: npm: portprocesses

### Impact

An Arbitrary Command Injection vulnerability was reported in `portprocesses` impacting versions <= 1.0.4.

### Example (Proof of Concept)

The following example demonstrates the vulnerability and will run `touch success` therefore creating a file named `success`.

```js const portprocesses = require("portprocesses");

portprocesses.killProcess("$(touch success)"); ```