@offactory/compress-fonts before 1.1.1 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying…
@offactory/compress-fonts before 1.1.1 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying font files with crafted names. Font paths are interpolated unquoted into a FontForge command run through child_process.execSync, so shell metacharacters in file names execute commands with the Node.js process privileges.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Node.js
- Product
- Node.js
- CVSS
- 7.8
- Exposure class
- Developer platform
Why it ranks 15 (Routine)
- CVSS 7.8 high
- Product class: developer platform
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.