CVE-2017-16034
Command Injection in pidusage
Affected versions of pidusage pass unsanitized input to child_process.exec(), resulting in arbitrary code execution in the ps method.
This package is vulnerable to this PoC on Darwin, SunOS, FreeBSD, and AIX.
Windows and Linux are not vulnerable.
Proof of Concept
var pid = require('pidusage');
pid.stat('1 && /usr/local/bin/python');
Recommendation
Update to version 1.1.5 or later.
What each source reports
GitHub AdvisoriesGHSA-hfq9-rfpv-j8r8 No score
Command Injection in pidusage
Affected versions of pidusage pass unsanitized input to child_process.exec(), resulting in arbitrary code execution in the ps method.
This package is vulnerable to this PoC on Darwin, SunOS, FreeBSD, and AIX.
Windows and Linux are not vulnerable.
Proof of Concept
var pid = require('pidusage');
pid.stat('1 && /usr/local/bin/python');
Recommendation
Update to version 1.1.5 or later.
- Record
GHSA-hfq9-rfpv-j8r8- Weakness
- CWE-77
- Updated
- 2026-11-02
OSVGHSA-hfq9-rfpv-j8r8 No score
Command Injection in pidusage
Affected versions of pidusage pass unsanitized input to child_process.exec(), resulting in arbitrary code execution in the ps method.
This package is vulnerable to this PoC on Darwin, SunOS, FreeBSD, and AIX.
Windows and Linux are not vulnerable.
Proof of Concept
var pid = require('pidusage');
pid.stat('1 && /usr/local/bin/python');
Recommendation
Update to version 1.1.5 or later.
- Record
GHSA-hfq9-rfpv-j8r8- Weakness
- CWE-77
- Updated
- 2026-11-02
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-16034 is a vulnerability with no CVSS score yet in pidusage, published September 1, 2020. No source lists public exploit code. Fixed in pidusage 1.1.5.