CVE WATCH / VULNERABILITY DETAIL
CVE-2020-37282
CRITICALCVSS 9.8NVD feed
Published 14 October 2026 · tracked since 15 October 2026
Description
office-converter through 1.0.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying a crafted fileName to generatePdf() or generateHtml(). Attackers can embed $(...), backticks, or a closing quote with shell metacharacters in the file name, which is c
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog
Latest tracked vulnerabilities
- CVE-2026-107381 MEDIUM 6.5
- CVE-2026-104939 HIGH 7.5
- CVE-2026-101019 MEDIUM 6.5
- CVE-2026-101025 MEDIUM 5.3
- CVE-2026-98417
- CVE-2026-98418
- CVE-2026-98419
- CVE-2026-98420
- CVE-2026-98409
- CVE-2026-98410