npm package node-latex-pdf 命令注入漏洞

The npm package node-latex-pdf is a package for converting latex files to pdf format from the US company npm. A command injection vulnerability exists in all versions of node-latex-pdf, which stems from the presence of command injection...

npm package node-latex-pdf 命令注入漏洞

The npm package node-latex-pdf is a package for converting latex files to pdf format from the US company npm. A command injection vulnerability exists in all versions of node-latex-pdf, which stems from the presence of command injection...

Command Injection

Overview node-latex-pdf is a package that converts your latex files to pdf format. Affected versions of this package are vulnerable to Command Injection. PoC var a =require"node-latex-pdf"; a"./","& touch JHU",function Remediation There is no fixed version for node-latex-pdf. Credit: JHU System...