CVE-2020-37282: office-converter through 1.0.2 contains an OS command injection vulnerability that allows attackers to execute commands …
office-converter through 1.0.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying a crafted fileName to generatePdf() or generateHtml(). Attackers can embed $(...), backticks, or a closing quote with shell metacharacters in the file name, which is concatenated into an unoconv command run via child_process.exec(), executing commands with Node.js process privileges.
- Published by source
- 2026-10-14
- First seen by Reality Radar
- 2026-10-26
- Last verified
- 2026-10-26
What the official notice says
Risk: critical severity (CVSS 9.8)
Is this affecting you?
Add what you own or use and Reality Radar will tell you when official changes match it — with evidence and next steps.
Sources
- NIST National Vulnerability Database Tier A · official published 2026-10-14
Evidence ledger
Every piece of evidence we store is appended to a public hash chain, so later edits are detectable. Anyone can re-verify it.
| Entry | Kind | Observed | Evidence hash | Entry hash |
|---|---|---|---|---|
| #1878 | new | 2026-10-26 | 35b0665fe0f1…95182a | 478dddced36f…717b12 |
Chain head: #1913 68d492d71c09…880c23