4 matches found
CVE-2018-3757
Command injection exists in pdf-image v2.0.0 due to an unescaped string parameter...
agneta-platform (>=0.13.0-beta.1, <=0.13.0-beta.9), aon (>=0.0.2, <=0.3.2) +6 more potentially affected by CVE-2018-3757 via pdf-image (1.1.0)
pdf-image NPM version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on pdf-image and may be impacted: - agneta-platform =0.13.0-beta.1, =0.0.2, =0.0.2, =0.1.1, =0.3.0, =0.1.1, =1.0.0, =0.0.1, =0.0.3 Source cves: CVE-2018-3757 Source advisory:...
CVE-2018-3757
pdf-image prior to 2.0.0 is vulnerable to command injection via an unescaped pdfFilePath parameter, enabling arbitrary shell commands to be executed (RCE). Impact is consistent with remote code execution if an attacker controls the input. The recommended remediation is to upgrade to version 2.0.0...
