Product
The office-converter library through version 1.0.2 is vulnerable to OS command injection via the fileName parameter, allowing arbitrary code execution with Node.js process privileges.