External risk intelligence

`tre*kill` Code Injection Allows Remote Code Execution on Windows.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2019-15598

The vulnerability exists in a Node.js library (tree-kill) used to manage process trees. It is a development-level dependency or build-time tool rather than an internet-facing service, appliance, or gateway. Common deployments of this library are internal to application code or build environments, making public internet exposure of the vulnerable code path extremely unlikely.

Code Injection

Tree Kill Project Tree Kill

before 1.2.2

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical code injection vulnerability within the tree-kill utility on Windows systems. The issue allows for remote code execution if an attacker can control the input to the command, potentially impacting systems utilizing this development tool. The main concern is confirming its relevance and exposure within our environment.

Attackers can run malicious code remotely.
It affects a development tool, not direct services.
Assess relevance and potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by controlling input to a command, potentially leading to remote code execution. This occurs within the treekill component on Windows.

No authentication or user interaction needed.
Attacker controls command input.
Leads to remote code execution.

Live Threat

Current exploitation, exposure, and threat context

A code injection vulnerability in tree-kill on Windows could allow an attacker to execute arbitrary code when they can control command input. This could affect system operations and potentially lead to unauthorized actions on the affected system.

System command execution could be compromised.
Attackers could control command input.
Unauthorized system actions may occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in tree-kill on Windows enables remote code execution if an attacker can control command input. Given its nature as a Node.js library likely used in development or build environments, the primary responsibility likely falls to development teams and platform engineers who manage application dependencies and build pipelines. The first practical step is to identify where this library is used within your development lifecycle, confirm if any external or unauthorized input can reach it, and then coordinate with the accountable owner for remediation during the next planned maintenance window or by updating the dependency.

Application and platform teams own the issue.
Verify external input can reach the library.
Update the dependency or plan remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is tree-kill and how is it used?

tree-kill is a Node.js utility designed to terminate process trees on Windows. Developers typically use it within application code or build pipelines to ensure that child processes are properly cleaned up when a parent task finishes. It is a utility library, not a standalone service or end-user application.

What does CVE-2019-15598 mean?

This vulnerability is classified as Code Injection (CWE-94) and OS Command Injection (CWE-78). In plain terms, it means the library fails to properly sanitize input before passing it to the system shell. An attacker who can influence the data passed to tree-kill might trick the computer into running unauthorized commands.

How does an attacker trigger this vulnerability?

Exploitation requires the attacker to gain control over the specific input being sent to the tree-kill utility. This bug does not automatically expose your entire server; it only functions if your application logic allows unvalidated external data to be passed directly into the command arguments of this specific library.

Do I need to worry about this if my app is internal?

Halo Surface Signal indicates that while the vulnerability allows for critical impact, it is very unlikely to be reachable from the public internet. Because tree-kill is usually a build-time tool or internal dependency, it rarely sits on the network perimeter. Focus your attention on applications that process untrusted user input.

When should I update or replace tree-kill?

First, identify if your project uses a version of tree-kill earlier than 1.2.2. If you find it, confirm whether your code allows external input to reach the library. If it does, prioritize updating the dependency to a secure version through your standard development and maintenance workflow.

References

hackerone.com/reports/703415

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.