CVE-2020-37282

9.8Critical

Published 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

9.8Critical

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-78

Impact

Remote attackers can execute arbitrary shell commands with the privileges of the Node.js application process. Exploitation requires sending a maliciously crafted filename to an endpoint utilizing generatePdf() or generateHtml().

Root cause

The package concatenates the user-supplied fileName parameter directly into an unescaped shell string executed via child_process.exec().

Affected systems

office-converter through 1.0.2

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Fix & remediation

No fixed version is available; remove the office-converter package or avoid passing untrusted filenames to generatePdf() and generateHtml() by strictly whitelisting filenames to alphanumeric characters before invocation.

shell

$ npm ls office-converter

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

office-converter through 1.0.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying a crafted fileName to generatePdf() or generateHtml(). Attackers can embed $(...), backticks, or a closing quote with shell metacharacters in the file name, which is concatenated into an unoconv command run via child_process.exec(), executing commands with Node.js process privileges.

References

Source: nvd.nist.gov/vuln/detail/CVE-2020-37282