CVE-2021-23380

HighCVSS 7.3/10Last modified Jun 17, 2026

Description

This affects all versions of package roar-pidusage. If attacker-controlled user input is given to the stat function of this package on certain operating systems, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Apr 18, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-233819.8This affects all versions of package killing. If attacker-controlled user input is given, it is possible for an attacker to execute arbitrar CVE-2021-233827.5The package postcss before 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation()CVE-2021-233839.8The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates comi CVE-2021-233845.4The package koa-remove-trailing-slashes before 2.0.2 are vulnerable to Open Redirect via the use of trailing double slashes in the URL when CVE-2021-233856.1This affects all versions of package Flask-Security. When using the get_post_logout_redirect and get_post_login_redirect functions, it is po CVE-2021-233866.5This affects the package dns-packet before 5.2.2. It creates buffers with allocUnsafe and does not always fill them before forming network p CVE-2021-233876.1The package trailing-slash before 2.0.1 are vulnerable to Open Redirect via the use of trailing double slashes in the URL when accessing the CVE-2021-233885.3The package forms before 1.2.1, from 1.3.0 and before 1.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via email validat CVE-2021-233899.8The package total.js before 3.4.9 are vulnerable to Arbitrary Code Execution via the U.set() and U.get() functions.CVE-2021-23394.9Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.25 and prio CVE-2021-233909.8The package total4 before 0.0.43 are vulnerable to Arbitrary Code Execution via the U.set() and U.get() functions.CVE-2021-233917.1This affects all versions of package calipso. It is possible for a malicious module to overwrite files on an arbitrary file system through t