ShadowTrackr

Search the CVE vulnerability database

Look up vulnerabilities by software, product or CVE number.

Vulnerability managementShadowTrackr CVSS score

1 result for “CVE-2020-37282”

CVEPublishedCVSSShadowTrackr CVSSSummary
CVE:
CVE-2020-37282
Published
2026-10-14
CVSS:
9.3
ShadowTrackr CVSS:
8.1
Summary:
office-converter through 1.0.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying a crafted fileName to generatePdf() or generateHtml(). Attackers can embed $(...), backticks, or a closing quote with shell metacharacters in the file name, which is concatenated into an unoconv command run via child_process.exec(), executing commands with Node.js process privileges.