CVE-2021-34082
Description
OS Command Injection vulnerability in allenhwkim proctree through 0.1.1 and commit 0ac10ae575459457838f14e21d5996f2fa5c7593 for Node.js, allows attackers to execute arbitrary commands via the fix function.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
OS command injection in proctree npm package via `fix` function allows arbitrary command execution.
Vulnerability
OS Command Injection vulnerability in allenhwkim proctree through version 0.1.1 and commit 0ac10ae575459457838f14e21d5996f2fa5c7593 for Node.js. The fix function does not sanitize user input, allowing attackers to inject arbitrary OS commands [1][2].
Exploitation
An attacker can control the input to the fix function, which is then passed unsanitized to a shell command. This enables execution of arbitrary commands with the privileges of the Node.js process [2].
Impact
Successful exploitation results in remote code execution (RCE), leading to full system compromise, data theft, or further network attacks [1].
Mitigation
No fixed version has been released. The repository appears unmaintained. Users should avoid using the fix function with untrusted input or consider replacing the package [3][4].
AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
proctreenpm | <= 0.1.1 | — |
Affected products
3- allenhwkim/proctreedescription
- Range: <=0.1.1
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
4- github.com/advisories/GHSA-cv76-rv4h-4mqcghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2021-34082ghsaADVISORY
- advisory.checkmarx.net/advisory/CX-2021-4783ghsax_refsource_MISCWEB
- github.com/allenhwkim/proctree/blob/master/index.jsghsax_refsource_MISCWEB
News mentions
0No linked articles in our index yet.