CVE-2020-37282

office-converter through 1.0.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying a crafted fileName to generatePdf or generateHtml. Attackers can embed $..., backticks, or a closing quote with shell metacharacters in the file name, which is...