critical9.8
CVE-2020-28464
This affects the package djv before 2.1.4.
Impact
This affects the package djv before 2.1.4. By controlling the schema file, an attacker can run arbitrary JavaScript code on the victim machine.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Djv Project | Djv | before 2.1.4 |
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/korzio/djv/blob/master/lib/utils/properties.js%23L55
- https://github.com/korzio/djv/pull/98/files
- https://snyk.io/vuln/SNYK-JS-DJV-1014545
- https://github.com/korzio/djv/blob/master/lib/utils/properties.js%23L55
- https://github.com/korzio/djv/pull/98/files
- https://snyk.io/vuln/SNYK-JS-DJV-1014545