{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aeasy-pdf-merge_projecteasy-pdf-merge/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:easy-pdf-merge_project:easy-pdf-merge:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.1,"id":"CVE-2020-37279"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["easy-pdf-merge (0.1.0-0.2.6)"],"_cs_severities":["high"],"_cs_tags":["command-injection","nodejs","software-vulnerability"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe npm package 'easy-pdf-merge' (versions 0.1.0 through 0.2.6) is vulnerable to OS command injection due to improper handling of user-supplied input. An attacker can exploit this by injecting shell metacharacters such as double quotes, semicolons, dollar-parenthesis sequences $(), or backticks into the 'source' paths, 'destination' path, or 'maxHeap' option. These inputs are passed directly to the 'child_process.exec()' function in Node.js, which interprets them as shell commands. As a result, the injected commands are executed with the privileges of the Node.js application process. This vulnerability (CVE-2020-37279) presents a significant risk to any environment hosting applications that process user-defined PDF merge requests, as it allows for full remote code execution on the underlying host.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to execute arbitrary system commands on the server running the vulnerable application. This may lead to total system compromise, exfiltration of sensitive data, or the establishment of persistent backdoors within the environment. Affected sectors include any organization utilizing Node.js applications that leverage the easy-pdf-merge library for document processing tasks.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately update the 'easy-pdf-merge' package to a version beyond 0.2.6.\u003c/li\u003e\n\u003cli\u003eIf updating is not feasible, implement strict input validation and sanitization for all parameters passed to the library, ensuring the removal of shell metacharacters before processing.\u003c/li\u003e\n\u003cli\u003eAudit applications utilizing this package for unauthorized child process execution using endpoint telemetry.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-12T22:39:33Z","date_published":"2026-10-12T22:39:33Z","id":"https://feed.craftedsignal.io/briefs/2026-10-easy-pdf-merge-command-injection/","summary":"The easy-pdf-merge package (versions 0.1.0 through 0.2.6) contains an OS command injection vulnerability via unsanitized input to child_process.exec(), allowing arbitrary code execution.","title":"OS Command Injection in easy-pdf-merge","url":"https://feed.craftedsignal.io/briefs/2026-10-easy-pdf-merge-command-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:easy-Pdf-Merge_project:easy-Pdf-Merge:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}