CVE-2017-16034
Command Injection in pidusage
CVE-2017-16034 is a vulnerability with no CVSS score yet in pidusage, published September 1, 2020. No source lists public exploit code. Fixed in pidusage 1.1.5.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1.1.5pidusage +1 more
Description
Affected versions of pidusage pass unsanitized input to child_process.exec(), resulting in arbitrary code execution in the ps method.
This package is vulnerable to this PoC on Darwin, SunOS, FreeBSD, and AIX.
Windows and Linux are not vulnerable.
Proof of Concept
var pid = require('pidusage');
pid.stat('1 && /usr/local/bin/python');
Recommendation
Update to version 1.1.5 or later.
Affected packages
What each source reports
GitHub AdvisoriesGHSA-hfq9-rfpv-j8r8No score
Command Injection in pidusage
Affected versions of pidusage pass unsanitized input to child_process.exec(), resulting in arbitrary code execution in the ps method.
This package is vulnerable to this PoC on Darwin, SunOS, FreeBSD, and AIX.
Windows and Linux are not vulnerable.
Proof of Concept
var pid = require('pidusage');
pid.stat('1 && /usr/local/bin/python');
Recommendation
Update to version 1.1.5 or later.
- Record
GHSA-hfq9-rfpv-j8r8- Weakness
- CWE-77
- Updated
- 2026-11-02
OSVGHSA-hfq9-rfpv-j8r8No score
Command Injection in pidusage
Affected versions of pidusage pass unsanitized input to child_process.exec(), resulting in arbitrary code execution in the ps method.
This package is vulnerable to this PoC on Darwin, SunOS, FreeBSD, and AIX.
Windows and Linux are not vulnerable.
Proof of Concept
var pid = require('pidusage');
pid.stat('1 && /usr/local/bin/python');
Recommendation
Update to version 1.1.5 or later.
- Record
GHSA-hfq9-rfpv-j8r8- Weakness
- CWE-77
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.