CVE-2020-37282 Details
Description
office-converter through 1.0.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying a crafted fileName to generatePdf() or generateHtml(). Attackers can embed $(...), backticks, or a closing quote with shell metacharacters in the file name, which is concatenated into an unoconv command run via child_process.exec(), executing commands with Node.js process privileges.
A remote code execution vulnerability has been identified in the 'office-converter' package, affecting all versions through 1.0.2. This vulnerability arises from improper input validation, allowing attackers to inject OS commands by crafting a file name with shell metacharacters. The manipulated file name is passed to the 'generatePdf()' or 'generateHtml()' functions, where it is concatenated into an 'unoconv' command executed via 'child_process.exec()'. This execution occurs with the privileges of the Node.js process, enabling command execution on the server.
No fix is currently available. Consider using an alternative module until a fix is made available.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| office-converter | <= 1.0.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 26, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | [email protected] |