ps Enables OS Command Injection

published 2018-09-07 8 y ago modified 2026-06-17 4 mo ago also GHSA-cfhg-9x44-78h2 , EUVD-2018-0452

cvss: 9.8; version 3.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 2.9%; EPSS 2.9% chance of exploitation in 30 days, percentile 86%
public exploits: 0; none known

A command Injection in ps package versions <1.0.0 for Node.js allowed arbitrary commands to be executed when attacker controls the PID.

Patch / fix

fixed in 2

npm ps 1.0.0
umbraengineering ps 1.0.0

Exploit prediction

2.86% chance of exploitation in the next 30 days, higher than 86% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
NVD	3.0	9.8	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	7.5	AV:N/AC:L/Au:N/C:P/I:P/A:P
GitHub	3.0	9.8	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem	package	affected	fixed in
npm	ps	<1.0.0	1.0.0

Affected products

https://github.com/UmbraEngineering ps

Classification

Weakness

CWE-77 Improper Neutralization of Special Elements used in a Command
CWE-78 Improper Neutralization of Special Elements used in an OS Command

References

hackerone.com /reports/390848
web, third-party-advisory
nvd.nist.gov /vuln/detail/CVE-2018-16460
advisory
github.com /advisories/GHSA-cfhg-9x44-78h2
advisory
github.com /nodejs/security-wg/blob/master/vuln/npm/470.json
web
npmjs.com /advisories/728
web

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary