CVSS 3.1
7.3 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:LCVE-2021-23380
High (7.3) in roar-pidusage project roar-pidusage. EPSS 1.2% chance of exploitation in the next 30 days.
This affects all versions of package roar-pidusage. If attacker-controlled user input is given to the stat function of this package on certain operating systems, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.
Severity
- EPSS
- 1.2% chance of exploitation in the next 30 days; higher than 67% of CVEs (scores of 2026-10-31)
- CWE
- CWE-78
- Published
- Modified
- Record from
- the NVD, synced
Affected
- roar-pidusage_project:roar-pidusage
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-xfxf-qw26-hr33 | npm | roar-pidusage | <=1.1.7 | no fix published |