npm aaptjs vulnerabilities

Latest npm aaptjs CVEs

Newest publication first

1. CVE-2020-36381 Vulnerability in singleCrunch function leads to arbitrary code execution via filePath parameters

   Published 2021-10-31

   Critical·CVSS 9.8 EPSS 1.9%

   An issue was discovered in the singleCrunch function in shenzhim aaptjs 1.3.1, allows attackers to execute arbitrary code via the filePath parameters.

2. CVE-2020-36379 Vulnerability in remove function leads to arbitrary code execution via filePath parameters

   Published 2021-10-31

   Critical·CVSS 9.8 EPSS 1.9%

   An issue was discovered in the remove function in shenzhim aaptjs 1.3.1, allows attackers to execute arbitrary code via the filePath parameters.

3. CVE-2020-36380 Vulnerability in crunch function leads to arbitrary code execution via filePath parameters

   Published 2021-10-31

   Critical·CVSS 9.8 EPSS 2.2%

   An issue was discovered in the crunch function in shenzhim aaptjs 1.3.1, allows attackers to execute arbitrary code via the filePath parameters.

4. CVE-2020-36378 Vulnerability in packageCmd function leads to arbitrary code execution via filePath parameters

   Published 2021-10-31

   Critical·CVSS 9.8 EPSS 1.9%

   An issue was discovered in the packageCmd function in shenzhim aaptjs 1.3.1, allows attackers to execute arbitrary code via the filePath parameters.

5. CVE-2020-36377 Vulnerability in dump function leads to arbitrary code execution via filePath parameters

   Published 2021-10-31

   Critical·CVSS 9.8 EPSS 1.9%

   An issue was discovered in the dump function in shenzhim aaptjs 1.3.1, allows attackers to execute arbitrary code via the filePath parameters.

6. CVE-2020-36376 Vulnerability in list function leads to arbitrary code execution via filePath parameters

   Published 2021-10-31

   Critical·CVSS 9.8 EPSS 1.9%

   An issue was discovered in the list function in shenzhim aaptjs 1.3.1, allows attackers to execute arbitrary code via the filePath parameters.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.