CVE-2020-37282

9.8 CRITICALpublic exploit available

Published 2026-10-14 · Updated 2026-10-16

AI risk analysis

Summary: The office-converter library has a command injection vulnerability that allows attackers to execute arbitrary OS commands with the privileges of the Node.js process. This is critical because it can lead to full system compromise.
Exploitability: Exploitation is straightforward requiring only a crafted filename in the generatePdf() or generateHtml() functions, with no additional authentication needed.
Blast radius: In a typical web application context, this vulnerability could allow attackers to execute arbitrary commands on the server, potentially leading to complete system takeover.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Upgrade to version 1.0.3 or later which contains the fix for the OS command injection vulnerability.

rcecommand-injectionnodejsweb

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

office-converter through 1.0.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying a crafted fileName to generatePdf() or generateHtml(). Attackers can embed $(...), backticks, or a closing quote with shell metacharacters in the file name, which is concatenated into an unoconv command run via child_process.exec(), executing commands with Node.js process privileges.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-78

Public exploit & PoC references

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.