{"id":"CVE-2019-5414","aliases":["EUVD-2019-0389","GHSA-pmv6-gf98-p3r5"],"status":"published","title":"Command Injection in kill-port","description":"If an attacker can control the port, which in itself is a very sensitive value, they can inject arbitrary OS commands due to the usage of the exec function in a third-party module kill-port \u003c 1.3.2.","severity":{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01887,"percentile":0.79673,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-77","CWE-78"],"published":"2019-03-17T19:42:05Z","modified":"2026-10-24T10:30:56Z","exploits":[{"source":"pocgithub","id":"crstaicu/CVE-2019-5414","title":"crstaicu/CVE-2019-5414","date":"2025-12-21","url":"https://github.com/crstaicu/CVE-2019-5414"}],"fixes":[{"ecosystem":"npm","package":"kill-port","fixed_in":["1.3.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"kill-port","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2"}]}]},{"source":"osv","ecosystem":"npm","package":"kill-port","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.3.2"}]}]}],"products":[{"vendor":"kill-port_project","product":"kill-port"}],"references":[{"url":"https://hackerone.com/reports/389561","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-5414","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-pmv6-gf98-p3r5","tags":["advisory"]},{"url":"https://www.npmjs.com/advisories/966","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-5414","description":"If an attacker can control the port, which in itself is a very sensitive value, they can inject arbitrary OS commands due to the usage of the exec function in a third-party module kill-port \u003c 1.3.2.","status":"published","published":"2019-03-17T19:42:05Z","modified":"2024-08-04T19:54:53.466Z","cwes":["CWE-77"],"updated_at":"2026-11-02T14:20:18.411291Z"}],"euvd":[{"id":"EUVD-2019-0389","description":"If an attacker can control the port, which in itself is a very sensitive value, they can inject arbitrary OS commands due to the usage of the exec function in a third-party module kill-port \u003c 1.3.2.","status":"published","published":"2019-03-17T19:42:05Z","modified":"2024-08-04T19:54:53Z","updated_at":"2026-11-03T03:06:52.999682Z"}],"ghsa":[{"id":"GHSA-pmv6-gf98-p3r5","title":"Command Injection in kill-port","description":"Versions of `kill-port` prior to 1.3.2 are vulnerable to Command Injection. The package does not validate user input on the `kill` function. This may allow attackers to run arbitrary commands in the system if user input (such as the port number) is passed directly to the function.\n\n\n## Recommendation\n\nUpgrade to version 1.3.2 or later.","status":"published","published":"2019-03-25T16:17:18Z","modified":"2023-09-08T19:57:08Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:37:03.287418Z"}],"nvd":[{"id":"CVE-2019-5414","description":"If an attacker can control the port, which in itself is a very sensitive value, they can inject arbitrary OS commands due to the usage of the exec function in a third-party module kill-port \u003c 1.3.2.","status":"published","published":"2019-03-21T16:01:05.437Z","modified":"2026-06-17T02:37:38.7Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":9.3,"vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-77","CWE-78"],"updated_at":"2026-11-02T14:05:07.268578Z"}],"osv":[{"id":"CVE-2019-5414","description":"If an attacker can control the port, which in itself is a very sensitive value, they can inject arbitrary OS commands due to the usage of the exec function in a third-party module kill-port \u003c 1.3.2.","status":"published","published":"2019-03-21T16:01:05.437Z","modified":"2026-10-24T10:30:56.865198985Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:12.675558Z"},{"id":"GHSA-pmv6-gf98-p3r5","title":"Command Injection in kill-port","description":"Versions of `kill-port` prior to 1.3.2 are vulnerable to Command Injection. The package does not validate user input on the `kill` function. This may allow attackers to run arbitrary commands in the system if user input (such as the port number) is passed directly to the function.\n\n\n## Recommendation\n\nUpgrade to version 1.3.2 or later.","status":"published","published":"2019-03-25T16:17:18Z","modified":"2023-11-08T04:01:35.436327Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T15:46:53.244788Z"}]}}