Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.3
CVE-2021-23380: Roar-pidusage Vulnerability Allows Command Execution on Certain OS
CVE-2021-23380 · published 5 years ago
Summary
All versions of Roar-pidusage are affected. If an attacker can input malicious data, they may be able to execute arbitrary system commands on certain operating systems. Update to the latest version to fix this issue.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| npm | marcfisher | roar-pidusage | <= 1.1.7 |
| – | roar-pidusage_project | roar-pidusage |
All versions
cpe:2.3:a:roar-pidusage_project:roar-pidusage:*:*:*:*:*:node.js:*:* |
Original advisory text
This affects all versions of package roar-pidusage. If attacker-controlled user input is given to the stat function of this package on certain operating systems, it is possible for an attacker to e...
This affects all versions of package roar-pidusage. If attacker-controlled user input is given to the stat function of this package on certain operating systems, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Severity
7.3
High
Type
CWE-77Command Injection
CWE-78OS Command Injection
Timeline
Published18 Apr 2021
Updated4 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta