critical9.8
CVE-2020-28429
Command Injection in geojson2kml
Impact
All versions up to and including version 0.1.1 of package geojson2kml are vulnerable to Command Injection via the index.js file. ### PoC: ```js var a =require("geojson2kml"); a("./","& touch JHU",function(){}) ```
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | geojson2kml | <= 0.1.1 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Geojson2kml Project | Geojson2kml | All versions |