Search
Find a vulnerability
Search criteria
2 vulnerabilities found for easy-pdf-merge by karuppiah7890
CVE-2020-37279 (GCVE-0-2020-37279)
Vulnerability from nvd – Published: 2026-10-12 20:55 – Updated: 2026-10-13 17:36
VLAI
EPSS
VEX
Title
easy-pdf-merge 0.1.0 through 0.2.6 OS Command Injection via merge function
Summary
easy-pdf-merge 0.1.0 through 0.2.6 contains an OS command injection vulnerability that allows attackers to execute commands by injecting shell metacharacters into source paths, destination path, or maxHeap option. Attackers can supply file names or options containing double quotes, semicolons, $() or backticks, which child_process.exec() runs through a shell with the Node.js process privileges.
Severity
8.1 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 17:35 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/karuppiah7890/easy-pdf-merge/pull/28 | issue-trackingpatch |
| https://github.com/karuppiah7890/easy-pdf-merge/pull/45 | issue-trackingpatch |
| https://github.com/karuppiah7890/easy-pdf-merge/b… | technical-description |
| https://github.com/karuppiah7890/easy-pdf-merge | product |
| https://www.vulncheck.com/advisories/easy-pdf-mer… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| karuppiah7890 | easy-pdf-merge |
Affected:
0.1.0 , ≤ 0.2.6
(semver)
|
Date Public
2020-09-10 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2020-37279",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T17:35:46.284981Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T17:36:30.801Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/karuppiah7890/easy-pdf-merge/pull/28"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/easy-pdf-merge",
"product": "easy-pdf-merge",
"repo": "https://github.com/karuppiah7890/easy-pdf-merge",
"vendor": "karuppiah7890",
"versions": [
{
"lessThanOrEqual": "0.2.6",
"status": "affected",
"version": "0.1.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "AGIPOO (Kim Jeong-hoon)"
},
{
"lang": "en",
"type": "finder",
"value": "Asjidkalam"
},
{
"lang": "en",
"type": "finder",
"value": "BrianWillows"
}
],
"datePublic": "2020-09-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "easy-pdf-merge 0.1.0 through 0.2.6 contains an OS command injection vulnerability that allows attackers to execute commands by injecting shell metacharacters into source paths, destination path, or maxHeap option. Attackers can supply file names or options containing double quotes, semicolons, $() or backticks, which child_process.exec() runs through a shell with the Node.js process privileges."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T20:55:03.883Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Pull Request #28",
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/karuppiah7890/easy-pdf-merge/pull/28"
},
{
"name": "GitHub Pull Request #45",
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/karuppiah7890/easy-pdf-merge/pull/45"
},
{
"name": "Vulnerable code in PDFMerger.js",
"tags": [
"technical-description"
],
"url": "https://github.com/karuppiah7890/easy-pdf-merge/blob/v0.2.6/source/lib/PDFMerger.js#L71-L75"
},
{
"tags": [
"product"
],
"url": "https://github.com/karuppiah7890/easy-pdf-merge"
},
{
"name": "VulnCheck Advisory: easy-pdf-merge 0.1.0 through 0.2.6 OS Command Injection via merge function",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/easy-pdf-merge-0.1.0-through-0.2.6-os-command-injection-via-merge-function"
}
],
"title": "easy-pdf-merge 0.1.0 through 0.2.6 OS Command Injection via merge function",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2020-37279",
"datePublished": "2026-10-12T20:55:03.883Z",
"dateReserved": "2026-10-12T19:27:41.300Z",
"dateUpdated": "2026-10-13T17:36:30.801Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2020-37279 (GCVE-0-2020-37279)
Vulnerability from cvelistv5 – Published: 2026-10-12 20:55 – Updated: 2026-10-13 17:36
VLAI
EPSS
VEX
Title
easy-pdf-merge 0.1.0 through 0.2.6 OS Command Injection via merge function
Summary
easy-pdf-merge 0.1.0 through 0.2.6 contains an OS command injection vulnerability that allows attackers to execute commands by injecting shell metacharacters into source paths, destination path, or maxHeap option. Attackers can supply file names or options containing double quotes, semicolons, $() or backticks, which child_process.exec() runs through a shell with the Node.js process privileges.
Severity
8.1 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 17:35 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/karuppiah7890/easy-pdf-merge/pull/28 | issue-trackingpatch |
| https://github.com/karuppiah7890/easy-pdf-merge/pull/45 | issue-trackingpatch |
| https://github.com/karuppiah7890/easy-pdf-merge/b… | technical-description |
| https://github.com/karuppiah7890/easy-pdf-merge | product |
| https://www.vulncheck.com/advisories/easy-pdf-mer… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| karuppiah7890 | easy-pdf-merge |
Affected:
0.1.0 , ≤ 0.2.6
(semver)
|
Date Public
2020-09-10 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2020-37279",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T17:35:46.284981Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T17:36:30.801Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/karuppiah7890/easy-pdf-merge/pull/28"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/easy-pdf-merge",
"product": "easy-pdf-merge",
"repo": "https://github.com/karuppiah7890/easy-pdf-merge",
"vendor": "karuppiah7890",
"versions": [
{
"lessThanOrEqual": "0.2.6",
"status": "affected",
"version": "0.1.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "AGIPOO (Kim Jeong-hoon)"
},
{
"lang": "en",
"type": "finder",
"value": "Asjidkalam"
},
{
"lang": "en",
"type": "finder",
"value": "BrianWillows"
}
],
"datePublic": "2020-09-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "easy-pdf-merge 0.1.0 through 0.2.6 contains an OS command injection vulnerability that allows attackers to execute commands by injecting shell metacharacters into source paths, destination path, or maxHeap option. Attackers can supply file names or options containing double quotes, semicolons, $() or backticks, which child_process.exec() runs through a shell with the Node.js process privileges."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T20:55:03.883Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Pull Request #28",
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/karuppiah7890/easy-pdf-merge/pull/28"
},
{
"name": "GitHub Pull Request #45",
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/karuppiah7890/easy-pdf-merge/pull/45"
},
{
"name": "Vulnerable code in PDFMerger.js",
"tags": [
"technical-description"
],
"url": "https://github.com/karuppiah7890/easy-pdf-merge/blob/v0.2.6/source/lib/PDFMerger.js#L71-L75"
},
{
"tags": [
"product"
],
"url": "https://github.com/karuppiah7890/easy-pdf-merge"
},
{
"name": "VulnCheck Advisory: easy-pdf-merge 0.1.0 through 0.2.6 OS Command Injection via merge function",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/easy-pdf-merge-0.1.0-through-0.2.6-os-command-injection-via-merge-function"
}
],
"title": "easy-pdf-merge 0.1.0 through 0.2.6 OS Command Injection via merge function",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2020-37279",
"datePublished": "2026-10-12T20:55:03.883Z",
"dateReserved": "2026-10-12T19:27:41.300Z",
"dateUpdated": "2026-10-13T17:36:30.801Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}