LiveActive security incident?Get immediate response
CVE Record

CVE-2021-23379: Arbitrary Command Injection

This affects all versions of package portkiller. If (attacker-controlled) user input is given, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.

HighCVSS 7.3Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

CVE-2021-23379 is a command injection issue in the npm package portkiller. If an attacker can control input passed to the package, the application may run unintended operating-system commands. The source bundle does not identify active exploitation or a vendor fix.

Executive priority

Treat as high priority if portkiller exists in production or deployment tooling reachable through user-controlled input. If absent, no direct action is needed beyond dependency monitoring.

Technical view

All versions of portkiller are listed as affected. The vulnerability is caused by using Node.js child_process exec without sanitizing attacker-controlled input, allowing arbitrary command execution in the context of the process using the package.

Likely exposure

Exposure is likely limited to applications or tooling that include portkiller and pass user-controlled input into it. The bundle does not show evidence that portkiller is commonly internet-facing by itself.

Exploitation context

The CVSS vector indicates network attackability, low complexity, no privileges, and no user interaction. KEV is false in the provided bundle, so active exploitation is not established here.

Researcher notes

Evidence is concise but consistent: the issue is command injection from unsanitized input passed to exec. The bundle does not provide exploit details, affected downstream applications, exploitation evidence, or a confirmed fixed version.

Mitigation direction

  • Inventory applications, scripts, and build tooling for the portkiller npm package.
  • Remove or replace portkiller where external input can reach it.
  • If retained, pass only trusted and strictly validated port values.
  • Check vendor, CVE, and Snyk guidance for any fixed release or workaround.
  • Add review checks for unsanitized child_process exec usage.

Validation and detection

  • Review package manifests, lockfiles, and SBOMs for portkiller.
  • Trace every caller to identify whether user input reaches portkiller.
  • Confirm no public route or API passes unsanitized values into it.
  • Document compensating controls where removal is delayed.
  • Retest affected paths after removing or replacing the dependency.
Prepared
Confidence
high
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

description · low confidence lookup

Execution behavior lookup

The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2021-23379 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.3 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
3Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.3CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P3.93.4Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

7.3High
CVSS 3.1 vector shape for CVE-2021-23379Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/aportkiller0Listed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.