What is GHSA-5gwh-g79j-vh4q?

GHSA-5gwh-g79j-vh4q is a security advisory published by GitHub Security Advisories with Critical severity. Command Injection in pdf-image

Which CVE IDs does GHSA-5gwh-g79j-vh4q cover?

GHSA-5gwh-g79j-vh4q covers the following CVE IDs: CVE-2018-3757. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-5gwh-g79j-vh4q?

GHSA-5gwh-g79j-vh4q has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-5gwh-g79j-vh4q?

GHSA-5gwh-g79j-vh4q affects 1 product, including: npm/pdf-image:\u003c 2.0.0.

GHSA-5gwh-g79j-vh4qCriticalCVSS 9.8

Command Injection in pdf-image

Vendor

GitHub Security Advisories

Published

September 1, 2020

Last Modified

January 9, 2023

🔗 CVE IDs covered (1)

CVE-2018-3757 →

📋 Description

Versions of pdf-image before 2.0.0 are vulnerable to command injection. This vulnerability is exploitable if the attacker has control over the pdfFilePath variable passed into pdf-image.

Recommendation

Update to version 2.0.0 or later.

🎯 Affected products1

npm/pdf-image:< 2.0.0

🔗 References (5)

https://hackerone.com/reports/340208
https://www.npmjs.com/advisories/670
https://nvd.nist.gov/vuln/detail/CVE-2018-3757
https://github.com/roest01/node-pdf-image/commit/54679496a89738443917608c2bbe2f6e5dd20e83
https://github.com/advisories/GHSA-5gwh-g79j-vh4q