Description

The pdfinfojs NPM module versions <= 0.3.6 has a command injection vulnerability that allows an attacker to execute arbitrary commands on the victim's machine.

Remediation

References

https://hackerone.com/reports/330957

Related Vulnerabilities

CVE-2023-26136 Vulnerability in npm package tough-cookie

CVE-2023-30537 Vulnerability in maven package org.xwiki.platform:xwiki-platform-flamingo-theme-ui

CVE-2022-35915 Vulnerability in maven package org.webjars.npm:openzeppelin__contracts-upgradeable

CVE-2023-27095 Vulnerability in maven package cn.hippo4j:hippo4j-core

CVE-2021-23379 Vulnerability in npm package portkiller

Severity

Critical

Classification

CWE-77 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Exploit Third Party Advisory