CVE-2020-37279criticalCWE-78

CVE-2020-37279: critical vulnerability in karuppiah7890 easy-pdf-merge

easy-pdf-merge 0.1.0 through 0.2.6 OS Command Injection via merge function

Published · Updated

Follow this CVE+ Monitor easy-pdf-merge

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.2epss 1.9%
easy-pdf-merge 0.1.0 through 0.2.6 contains an OS command injection vulnerability that allows attackers to execute commands by injecting shell metacharacters into source paths, destination path, or maxHeap option. Attackers can supply file names or options containing double quotes, semicolons, $() or backticks, which child_process.exec() runs through a shell with the Node.js process privileges.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
karuppiah7890 · easy-pdf-merge