CVE-2018-3746 Command Injection in pdfinfojs
CriticalCVSS 9.8
EPSS 4.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The pdfinfojs NPM module versions <= 0.3.6 has a command injection vulnerability that allows an attacker to execute arbitrary commands on the victim's machine.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| npm pdfinfojs(npm) | < 0.4.1 | 0.4.1 |
| pdfinfojs project pdfinfojs | <= 0.3.6 | No fix listed |
| HackerOne pdfinfojs | = <=0.3.6 | No fix listed |
References
- nvd.nist.gov third-party-advisory
- github.com patch
- hackerone.com exploit third-party-advisory
- github.com
- www.npmjs.com