PT-2026-110915

CVE-2020-37279

Published

2026-10-12

Updated

2026-10-13

Description by

CVSS 4.0

9.2

Critical

MetricsAV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions easy-pdf-merge versions 0.1.0 through 0.2.6

Description An OS command injection flaw allows attackers to execute arbitrary commands by injecting shell metacharacters into the source paths, destination path, or the maxHeap option. This occurs because the child process.exec() function runs these inputs through a shell using the privileges of the Node.js process. Attackers can trigger this by providing file names or options containing double quotes, semicolons, $(), or backticks.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploitability

Exploit

Impacts

Researchers

Agipoo

Asjidkalam

Brianwillows

Vendors

Affected products

Weakness enumeration

CWE-78: Improper Neutralization of Special Elements used in an OS Command (\'OS Command Injection\')