CVE-2019-15598

Vulnerability

The tree-kill npm package, which provides a cross-platform way to kill process trees, contains a code injection vulnerability in its Windows implementation. The flaw arises because the package passes the pid parameter directly to a shell command without sanitization. On Windows, the library uses taskkill /pid PID /T /F to kill a process tree. If an attacker can control the pid value, they can inject arbitrary commands that will be executed by the shell [1][3].

Exploitation

The attack vector relies on an attacker being able to supply a malicious pid argument to the tree-kill function. No authentication is required if the function is used in a context where untrusted user input reaches the pid parameter (e.g., a web application accepting a process ID from user input). On Windows, the injected string can include shell metacharacters such as |, &, or ; to execute arbitrary commands alongside the intended taskkill command [2][3].

Impact

Successful exploitation enables arbitrary code execution on the target system with the same privileges as the process that called tree-kill. An attacker could install programs, modify data, create new accounts, or perform any other action allowed by those privileges. The vulnerability is classified as critical and was assigned CVE-2019-15598 with a CVSS v3 score of 9.8 [2].

Mitigation

The maintainers patched the issue in version 1.2.2 of tree-kill, released on 2019-12-11. The fix sanitizes the pid parameter by ensuring it is a numeric value before passing it to the shell command [1][4]. Users should update to version 1.2.2 or later. No workaround is available other than upgrading.