CVE-2020-36378

Name of the Vulnerable Software and Affected Versions: shenzhim aaptjs version 1.3.1

Description: An issue was discovered in the packageCmd function, allowing attackers to execute arbitrary code via the filePath parameters. This issue affects the shenzhim aaptjs package, which is a node wrapper for aapt.

Recommendations: For shenzhim aaptjs version 1.3.1, consider disabling the packageCmd function until a patch is available to prevent exploitation via the filePath parameters. Restrict access to the filePath parameters in the affected function to minimize the risk of arbitrary code execution. At the moment, there is no information about a newer version that contains a fix for this vulnerability.