CVE-2019-15609:
OS Command Injection and Command Injection in kill-port-process
9.8
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.91155%
CWE
Published
2/10/2022
Updated
2/1/2023
KEV Status
No
Technology
JavaScript
JavaScriptTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| kill-port-process | npm | <= 2.2.0 | 2.2.1 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability stems from using child_process.exec() with unsanitized input in two methods:
- win32Kill directly interpolated PID into TASKKILL command
- unixKill used raw port value in a shell pipeline Both would appear in runtime profiles when processing malicious input. The patch replaces exec() with spawn() and argument arrays, confirming the original code was vulnerable to command injection via parameter manipulation.