CVE-2021-23375: 
JavaScript vulnerability analysis and mitigation

CVE-2021-23375 is a vulnerability in the psnode Node.js module that allows arbitrary command injection. The vulnerability was disclosed and published on April 18, 2021. The affected package psnode is used for listing and killing processes on OSX and Windows systems. This vulnerability affects all versions of the psnode package with no fixed version available (Snyk).

The vulnerability exists due to insufficient input sanitization in the kill function, which uses the child_process exec function without proper validation. The vulnerability has a CVSSv3 base score of 7.3 (High severity). The attack vector is Network-based, with Low attack complexity, requiring No privileges and No user interaction for exploitation (Snyk).

Successful exploitation of this vulnerability allows attackers to execute arbitrary commands on the affected system. The impact includes potential loss of confidentiality, integrity, and availability, though the attacker's control over modifications is limited. The vulnerability can affect system resources but does not typically result in complete service denial (Snyk).

The vulnerability is considered highly exploitable with a proof-of-concept available. A simple example of exploitation involves passing attacker-controlled input to the kill function: psnode.kill('$(touch success)', function() {}); which would create a file named 'success' on the system (Snyk).

There is currently no fixed version available for the psnode package. Users are advised to either discontinue use of the package or implement additional input validation before passing data to the kill function (Snyk).