~ / search / GHSA-4hv7-3q38-97m8

GHSA-4hv7-3q38-97m8

Arbitrary code execution in djv

Source: GitHub Advisory Database (reviewed) Critical CVE-2020-28464

Packages

EcosystemPackageAffectedFixed in
npm djv < 2.1.4 2.1.4

Details

As written in the advisory (Markdown source, shown as plain text).

This affects the package djv before 2.1.4. By controlling the schema file, an attacker can run arbitrary JavaScript code on the victim machine.

References

External links from the advisory. They lead to third-party sites.