CVE-2020-28447

This affects all versions of package xopen. The injection point is located in line 14 in index.js in the exported function xopenfilepath...

xopen(filepath) Command Execution

The vulnerability of the “xopenfilepath” function in the application for working with xopen files in npm exists because measures to neutralize special elements used in the operating system command have not been taken. Exploiting this vulnerability allows a malicious actor to execute arbitrary...