CVE-2020-28429
Command Injection
Vexday Risk Score
48Attention
SSVC decision (CISA)
Attend
PoC available → attend closely
Exploit maturity
Functional exploit
Automatable exploit available (Nuclei/Metasploit).
CVSS 7.3EPSS 63.3%KEV nãoPoC —Nuclei simMetasploit —Patch —
Lifecycle
23 Feb 2021Published on NVD
Recommendation: Plan a near-term fix — a public PoC already exists.
All versions of package geojson2kml are vulnerable to Command Injection via the index.js file. PoC: var a =require("geojson2kml"); a("./","& touch JHU",function(){})
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Affected products
n/a · geojson2kml