CVE-2020-28429

Command Injection

High · published February 23, 2021

Patch now

High probability of exploitation

CVSS calls it high at 7.3. It sits in the 99.2th percentile for exploit probability.

CVSS v3.1

7.3

EPSS

63%

Percentile

99.2

In the wild

Unconfirmed

What it is

All versions of package geojson2kml are vulnerable to Command Injection via the index.js file. PoC: var a =require("geojson2kml"); a("./","& touch JHU",function(){})

The record

Technical detail

CVSS v3.1: 7.3 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0: Not supplied
EPSS: 0.63305 · 99.2th percentile
Published: 2021-02-23T15:10Z

EPSS history

Timeline

23 FEB 15:10Z
Command Injection
cvelistv5