CVE Vulnerability Catalog

Stills before 25.24.2 contains an OS command injection vulnerability allowing attackers to execute shell commands by supplying crafted media file paths, with Node.js process privileges.

Vulnerability in @offactory/compress-fonts before 1.1.1 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying font files with crafted names. Font paths are interpolated unquoted into a FontForge command run through child_process.execSync, so shell metacharacters in file names execute commands with the Node.js process privileges.

Turnpress through 0.4.2 contains an OS command injection vulnerability. The convertDocxToHtml function in src/converter.ts invokes pandoc through execa with shell:true, allowing shell metacharacters in the --docx path to execute commands with the victim's privileges.

Beganovich snappdf from 1.1.0 before 6.1.0 contains an OS command injection vulnerability on Windows. Attackers can supply cmd.exe metacharacters such as & in the setUrl() value, which executeOnWindows() passes unescaped to PHP exec().

Video-stitch before 2.0.0-beta.1 contains an OS command injection vulnerability allowing attackers to execute commands by supplying file names interpolated unquoted into shell-executed ffmpeg command lines, with Node.js process privileges.

nodejs-whisper through 0.3.1 contains an OS command injection vulnerability in convertToWavType() allowing attackers to execute commands by supplying crafted audio file paths, with Node.js process privileges.

transcribe2texts through 1.0.6 contains an OS command injection vulnerability. Attackers can supply crafted audioPath values to transcribeAudio(), injecting $() or backtick substitution into the unescaped path passed to child_process.exec(), executing commands with Node.js process privileges.

xhtml2pdf before 0.2.19 contains an OS command injection vulnerability in pisa.startViewer(). Attackers can supply an input file whose name contains a double quote and shell metacharacters, which runs OS commands as the invoking user when the pisa tool is used with -s/--start-viewer.

@runnerty/executor-decompress through 3.1.1 contains an OS command injection vulnerability. Attackers can supply crafted archive file names to compress_file, injecting $() substitutions or unquoted shell metacharacters into shelljs exec() calls.

Whisper-node through 1.1.1 contains an OS command injection vulnerability. Attackers can supply crafted filePath or whisperOptions.language values to whisper(), injecting shell metacharacters or $() substitution into the command string built by createCppCommand() and run via shelljs exec(), executing commands with Node.js process privileges.

@mborne/extract before 0.2.1 contains an OS command injection vulnerability. Attackers can supply shell metacharacters in archivePath or targetDir options passed to extract(), injecting commands into unquoted shelljs exec() strings in the unzip, 7z, tar-bz2 and gz extractors, running them with Node.js process privileges.

doc-recog through 1.1.6 contains an OS command injection vulnerability. Attackers can supply crafted document paths to recog() or tag(), embedding $(...) or backtick command substitution in the file path that DocData._readPDF passes to a shell-based pdftotext exec call, running commands with Node.js process privileges.

buildebooks before 0.2.2 contains an OS command injection vulnerability in lib/kindle.js. Attackers can craft a book project with a malicious front-matter filename or project folder name and kindle: true to execute OS commands as the user running buildebooks.

pypdftk through 0.5 contains an OS command injection vulnerability in fill_form(), dump_data_fields(), and pdftk_cmd_util() that build shell commands from caller-supplied paths. Attackers controlling pdf_path or out_file can inject shell metacharacters interpreted by subprocess.Popen with shell=True, executing OS commands as the Python process.

webp-converter before 3.0.0 contains an OS command injection vulnerability in src/webpconverter.js helpers that run libwebp binaries via execFile with shell enabled. Attackers controlling file names or option strings passed to cwebp, dwebp, gwebp, or webpmux functions can inject shell metacharacters to execute OS commands as the Node.js process.

git-diff before 2.0.7 contains an OS command injection vulnerability. Attackers can supply crafted strings to the gitDiff API, embedding $(cmd) or backtick substitutions that shelljs.exec evaluates, running commands with Node.js process privileges.

MyReport Updater through 2.1.1 contains a local privilege escalation vulnerability. Low-privileged users can make the SYSTEM updater service install attacker-supplied archives into arbitrary directories, planting a DLL like HID.dll loaded by osk.exe to gain SYSTEM privileges.

Report One MyReport Updater through 2.1.1 exposes an unauthenticated gRPC service on TCP port 9095. Remote attackers can redirect the SYSTEM updater by invoking the UpdateConfigReferent method and pointing it to a malicious reference server.

Komodo through 2.3.3 contains an authentication bypass vulnerability in the Periphery agent that allows unauthenticated attackers to connect as a trusted Core because empty core_public_keys and passkeys lists fail open by default. Attackers reaching port 8120 can present any generated keypair to issue Periphery API requests, including terminal sessions and container operations, executing commands on managed hosts typically as root.

VentureDrake Laravel CRM before 2.4.0 contains an incorrect authorization vulnerability in user management that allows authenticated administrators to assign unrestricted roles via Role::find. Attackers with user-management access can assign the Owner role or other teams' roles and delete cross-team users through the unscoped UserIndex delete() method.