CVE-2020-36380

Name of the Vulnerable Software and Affected Versions: aaptjs version 1.3.1

Description: An issue was discovered in the crunch function in shenzhim aaptjs, allowing attackers to execute arbitrary code via the filePath parameters. This issue affects the aaptjs node wrapper for aapt.

Recommendations: For aaptjs version 1.3.1, consider restricting access to the crunch function until a patch is available. As a temporary workaround, avoid using the filePath parameters in the affected function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.