AIKIDO-2026-268370

node-os-utils is vulnerable to Command Injection

Command Injection Pre-CVE Published Jul 21, 2026

High Risk

This Affects:

node-os-utils

2.0.1 - 2.0.3

Fixed in 2.0.4

Are you affected? Scan for Free

TL;DR

The node-os-utils library manages processes through ProcessMonitor.kill, which on Linux and macOS builds a shell command by interpolating the caller-supplied signal and PID into kill -${signal} ${pid}. Because the command runs through a shell, untrusted input passed as the signal argument can inject and execute arbitrary OS commands on the host. Related process query, open-file, and environment lookups also run through the shell without validating the PID at runtime. The fix sends signals through the native Node.js process.kill API instead of a shell and validates PID and signal inputs.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and your application passes untrusted input as the signal or PID argument to the process kill API.