EXPOSURES › CVE-2020-37282
CVE-2020-37282
CRITICALoffice-converter through 1.0.2 allows remote OS command injection via crafted file names in PDF/HTML generation functions.
An attacker can execute arbitrary commands with Node.js process privileges by embedding shell metacharacters in file names passed to generatePdf() or generateHtml(). This is a critical RCE flaw that violates CMMC/NIST 800-171 requirements for preventing unauthorized command execution and protecting system integrity. DIB organizations must patch this immediately and restrict untrusted file processing to avoid supply-chain compromise.
Shame score — A critical CVSS 9.8 OS command injection flaw in a widely used library that allows remote attackers to execute arbitrary commands with elevated privileges, representing a severe avoidable failure in secure coding practices.
▸ RECOMMENDED ACTION Remote code execution — patch the affected products on priority.
office-converter through 1.0.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying a crafted fileName to generatePdf() or generateHtml(). Attackers can embed $(...), backticks, or a closing quote with shell metacharacters in the file name, which is concatenated into an unoconv command run via child_process.exec(), executing commands with Node.js process privileges.