{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/office-converter--1.0.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:office-converter_project:office-converter:*:*:*:*:*:node.js:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2020-37282"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["office-converter (\u003c= 1.0.2)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe office-converter npm package, versions 1.0.2 and earlier, contains a critical OS command injection vulnerability (CVE-2020-37282). The vulnerability exists within the generatePdf() and generateHtml() functions, which fail to properly sanitize the fileName parameter before passing it to the unoconv command. This command is invoked via the Node.js child_process.exec() method. By supplying a specially crafted file name containing shell metacharacters such as backticks, $(...), or closing quotes, an attacker can escape the intended parameter context and execute arbitrary system commands. Since the command is executed by the Node.js process, the attacker gains the execution context and privileges of the application running the library. This poses a significant risk to any web application or backend service utilizing the office-converter library for document conversion tasks.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows for unauthenticated arbitrary command execution on the host system. If successfully exploited, an attacker could gain full control over the application server, leading to sensitive data exfiltration, system modification, or pivoting into internal networks. This vulnerability affects all applications that rely on the affected version of the office-converter library to process user-supplied file names or paths during document conversion.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately update the office-converter dependency to a version beyond 1.0.2.\u003c/li\u003e\n\u003cli\u003eIf updating is not immediately feasible, implement strict input validation on all file names passed to the generatePdf() and generateHtml() functions, ensuring no shell metacharacters (e.g., ;, |, \u0026amp;, $, `, ,) are permitted.\u003c/li\u003e\n\u003cli\u003eReview logs for unusual process spawning activities stemming from the Node.js application process, such as unexpected child processes spawned by unoconv or shell interpreters like sh, bash, or cmd.exe.\u003c/li\u003e\n\u003cli\u003eApply the principle of least privilege by running the application process under a dedicated service account with minimal filesystem and network permissions.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-14T16:32:41Z","date_published":"2026-10-14T16:32:41Z","id":"https://feed.craftedsignal.io/briefs/2026-10-cve-2020-37282/","summary":"The office-converter library through version 1.0.2 is vulnerable to OS command injection via the fileName parameter, allowing arbitrary code execution with Node.js process privileges.","title":"Command Injection in office-converter Library","url":"https://feed.craftedsignal.io/briefs/2026-10-cve-2020-37282/"}],"language":"en","title":"CraftedSignal Threat Feed - Office-Converter (\u003c= 1.0.2)","version":"https://jsonfeed.org/version/1.1"}