CVE-2020-37282 — office-converter through 1.0.2 OS Command Injection via fileName in generatePdf
office-converter through 1.0.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying a crafted fileName to generatePdf() or gener…
Published: 2026-10-14 · CVSS: 9.3 · CVSS 4.0
office-converter through 1.0.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying a crafted fileName to generatePdf() or generateHtml(). Attackers can embed $(...), backticks, or a closing quote with shell metacharacters in the file name, which is concatenated into an unoconv command run via child_process.exec(), executing commands with Node.js process privileges.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7