{"vulnerability": "CVE-2020-37282", "sightings": [{"uuid": "9ba3cab2-6b22-4b46-8079-89edfb7d98b9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-37282", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxtuhizzr624", "content": "CVE-2020-37282 - office-converter\nThe office-converter library (versions up to 1.0.2) runs a system conversion tool using the file name you provide. If a specially crafted name is used, it can cause\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#officeconverter #vworld4u #CVE #infosec", "creation_timestamp": "2026-10-14T15:30:05.106324Z"}, {"uuid": "69fd7a18-b942-4768-8512-39c2a4f3f13b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-37282", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mxtwl5daam24", "content": "\ud83d\udea8 CVE-2020-37282 \u2014 CVSS 9.3 CRITICAL\n\noffice-converter through 1.0.2 contains an OS command injection vulnerability that allows attackers to exec...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2020-37282\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-10-14T16:07:54.354039Z"}, {"uuid": "87af51ec-94d3-4a3b-b8c5-080281ad602a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-37282", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117440807323407184", "content": "CVE-2020-37282 office-converter through 1.0.2 OS Command Injection via fileName in generatePdf office-converter through 1.0.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying a crafted fileName to generatePdf() or generateHtml(). Attackers can embed $(...), backticks, or a closing quote with shell metacharacters in the file name, which is concatenated into an unoconv command run via child_process.exec(), executing commands with Node.js process privileges.\nhttps://www.cve.org/CVERecord?id=CVE-2020-37282https://github.com/advisories/GHSA-9p64-h5q4-phpmhttps://github.com/vworld4u/office-converter/pull/9https://github.com/vworld4u/office-converter/blob/b1ea855d0001dc7a5d66343698634dbc06b72c2d/index.js#L19-L20https://www.vulncheck.com/advisories/office-converter-through-1.0.2-os-command-injection-via-filename-in-generatepdf#vworld4u #office-converter#CVE_2020_37282#bot", "creation_timestamp": "2026-10-14T19:01:46.801954Z"}]}