Is it possible to make a process.send cmd: "NODE_*" attack while under --experimental-pemission?

[LongTengDao]

child_process.fork('', [], {
    execArgv: [
        '--experimental-permission',
        '-e', 'process.send({ cmd: "NODE_*" });',
    ]
});

Will this api be a security problem in any case to cause parent process work wrong?

[RafaelGSS]

No. The process.send() method is used to send messages via IPC, it can be a problem if you eval the message in the parent process.

[LongTengDao]

@RafaelGSS the docs says cmd property with string value which start with NODE_ is for internal use:

https://github.com/nodejs/node/blame/1858341377c268c5ffce9345517dc07b0e6c240a/doc/api/child_process.md#L1536

[RafaelGSS]

Yes, but it wouldn't trigger any fs call. Also, if the parent process was created using the experimental permission, it should be ok.