{"id":"CVE-2020-37282","published":"2026-10-14T15:16:59.520","lastModified":"2026-10-16T19:18:44.867","description":"office-converter through 1.0.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying a crafted fileName to generatePdf() or generateHtml(). Attackers can embed $(...), backticks, or a closing quote with shell metacharacters in the file name, which is concatenated into an unoconv command run via child_process.exec(), executing commands with Node.js process privileges.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-78"],"vendors":[],"products":[],"references":[{"url":"https://github.com/advisories/GHSA-9p64-h5q4-phpm","tags":[]},{"url":"https://github.com/vworld4u/office-converter/blob/b1ea855d0001dc7a5d66343698634dbc06b72c2d/index.js#L19-L20","tags":[]},{"url":"https://github.com/vworld4u/office-converter/pull/9","tags":[]},{"url":"https://www.vulncheck.com/advisories/office-converter-through-1.0.2-os-command-injection-via-filename-in-generatepdf","tags":[]}],"exploitRefs":[{"url":"https://github.com/advisories/GHSA-9p64-h5q4-phpm","tags":[]},{"url":"https://github.com/vworld4u/office-converter/blob/b1ea855d0001dc7a5d66343698634dbc06b72c2d/index.js#L19-L20","tags":[]},{"url":"https://github.com/vworld4u/office-converter/pull/9","tags":[]}],"hasPoc":true,"ai":{"summary":"The office-converter library has a command injection vulnerability that allows attackers to execute arbitrary OS commands with the privileges of the Node.js process. This is critical because it can lead to full system compromise.","exploitability":"Exploitation is straightforward requiring only a crafted filename in the generatePdf() or generateHtml() functions, with no additional authentication needed.","blast_radius":"In a typical web application context, this vulnerability could allow attackers to execute arbitrary commands on the server, potentially leading to complete system takeover.","remediation":"Upgrade to version 1.0.3 or later which contains the fix for the OS command injection vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","command-injection","nodejs","web"],"model":"garnet-coder","analyzedAt":"2026-10-15T08:48:00.151Z"}}