CVE-2021-23355: 
JavaScript vulnerability analysis and mitigation

CVE-2021-23355 is a vulnerability affecting the ps-kill npm package, which was disclosed on February 23, 2021, and published on March 15, 2021. The vulnerability allows for Arbitrary Command Injection in all versions of the ps-kill package, which is designed to kill processes with ease (Snyk).

The vulnerability is classified as a Command Injection vulnerability (CWE-77) with a CVSS v3.1 base score of 9.8 (critical) according to NVD, while Snyk rates it at 5.6 (medium). The vulnerability exists due to the use of the child_process exec function without proper input sanitization in the index.js file (Snyk).

When exploited, this vulnerability allows attackers to execute arbitrary commands through the kill function if attacker-controlled user input is provided. The impact affects the confidentiality, integrity, and availability of the system, though each with limited direct consequences (Snyk).

The vulnerability has a proof-of-concept exploit available. A sample exploit involves using the kill function with malicious input: var ps_kill = require('ps-kill'); ps_kill.kill('$(touch success)',function(){}); This allows for arbitrary command execution (Snyk).

There is no fixed version available for the ps-kill package. Users are advised to consider alternative packages or implement additional input validation before passing data to the kill function (Snyk).