CVE-2021-45459: 
JavaScript vulnerability analysis and mitigation

The node-windows package before version 1.0.0-beta.6 for Node.js contains a command injection vulnerability (CVE-2021-45459) that allows attackers to execute arbitrary commands via the PID parameter in lib/cmd.js (NIST NVD, GitHub Advisory).

The vulnerability exists in the lib/cmd.js file where the PID parameter is not properly sanitized before being used in command execution. An attacker can inject malicious commands by including shell metacharacters in the PID parameter. For example, an attacker can execute arbitrary commands by passing a PID value like '12345; calc.exe' (GitHub Advisory).

Successful exploitation of this vulnerability could lead to arbitrary command execution on the affected system. According to NetApp's security advisory, this could result in disclosure of sensitive information, addition or modification of data, or Denial of Service (DoS). The vulnerability has received a CVSS v3.1 score of 9.8 (CRITICAL) (NetApp Security).

The vulnerability has been fixed in node-windows version 1.0.0-beta.6. Users should upgrade to this version or later to mitigate the risk. The fix prevents arbitrary command execution by implementing proper input validation (GitHub Compare).