CVE-2021-23380
Medium
Description
This affects all versions of package roar-pidusage. If attacker-controlled user input is given to the stat function of this package on certain operating systems, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.
SeverityMedium
CVSS5.6
Exploit probability—
ProductRoar-pidusage
PublishedApr 18, 2021
First seenApr 18, 2021
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| roar-pidusage_project roar-pidusage | No range specified | — |
| roar-pidusagenpm | v ≤ 1.1.7 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.