Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
A Code Injection exists in treekill and tree-kill on Windows which allows a remote code execution when an attacker is able to control the input into the command. Steps To Reproduce: Create the following PoC file: Execute the following commands in terminal: The HACKED.txt has been created
Recommended action: Upgrade to 1.2.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Versions of tree-kill prior to 1.2.2 are vulnerable to Command Injection. The package fails to sanitize values passed to the kill function. If this value is user-controlled it may allow attackers to run arbitrary commands in the server. The issue only affects Windows systems. Recommendation Upgrade to version 1.2.2 or later.
Recommended action: Upgrade to 1.2.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.