CVE-2020-37279

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2020-37279

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-37279.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2020-37279

Published

2026-10-12T21:17:05Z

Modified

2026-10-15T02:45:06Z

Severity

9.2 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator

Summary

[none]

Details

easy-pdf-merge 0.1.0 through 0.2.6 contains an OS command injection vulnerability that allows attackers to execute commands by injecting shell metacharacters into source paths, destination path, or maxHeap option. Attackers can supply file names or options containing double quotes, semicolons, $() or backticks, which child_process.exec() runs through a shell with the Node.js process privileges.

References

Affected packages

Git / github.com/karuppiah7890/easy-pdf-merge

Affected ranges

Type

GIT

Repo

https://github.com/karuppiah7890/easy-pdf-merge

Events

Introduced

Fixed

d86be6c8488265a8801e28853b650dd06143bb51

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "0.1.0"
        },
        {
            "fixed":  "0.2.6"
        }
    ],
    "source":  "DESCRIPTION"
}

Affected versions

0.*

0.2.1

v0.*

v0.2.2

v0.2.3

v0.2.4

v0.2.5

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-37279.json"