GitHub Advisoryadvisory · npm

GHSA-5gwh-g79j-vh4q Command Injection in pdf-image

CRITICAL Published 2020-09-01 Modified 2021-09-24 Official page ↗
Aliases
CVE-2018-3757
Ecosystem
npm
Packages
pdf-image
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-78
Reviewed
2020-08-31

Affected packages

• npm pdf-image: < 2.0.0 → fixed in 2.0.0

Description

Versions of `pdf-image` before 2.0.0 are vulnerable to command injection. This vulnerability is exploitable if the attacker has control over the `pdfFilePath` variable passed into `pdf-image`. Recommendation Update to version 2.0.0 or later.

Related

Alias · CVE (1)

  • CVE-2018-3757 Command injection exists in pdf-image v2.0.0 due to an unescaped string parameter. vulnerability

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References