CVE-2021-23363

Arbitrary Command Injection

State: Published
Severity: 6.3 Medium
Published: Mar 30, 2021
Updated: Sep 17, 2024
Reserved: Jan 8, 2021

Description

This affects the package kill-by-port before 0.0.2. If (attacker-controlled) user input is given to the killByPort function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.

Scores

CVSS	Score	Vector	Source
3.1	6.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P	snyk

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
kill-by-portn/a	before 0.0.2Affected

References

https://snyk.io/vuln/SNYK-JS-KILLBYPORT-1078531
https://github.com/GuyMograbi/kill-by-port/blob/16dcbe264b6b4a5ecf409661b42836dd286fd43f/index.js%23L8
https://github.com/GuyMograbi/kill-by-port/commit/ea5b1f377e196a4492e05ff070eba8b30b7372c4

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.