CVE-2020-28429

Description

All versions up to and including version 0.1.1 of package geojson2kml are vulnerable to Command Injection via the index.js file. ### PoC: ```js var a =require("geojson2kml"); a("./","& touch JHU",function(){}) ```

How to fix CVE-2020-28429

No fixed version has been published yet. Mitigate by removing the affected package or applying upstream guidance from the references below.

• npm/geojson2kml—no fix listed

Is CVE-2020-28429 being exploited?

Likely — EPSS is 84.8%, placing CVE-2020-28429 in the top tier of vulnerabilities by exploitation probability. Prioritise patching.

Affected packages (1)

• from 0, <= 0.1.1

CVSS scores

References (2)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2020-28429
• WEBsnyk.io/vuln/SNYK-JS-GEOJSON2KML-1050412