GHSA-4qwq-q4pr-rr7r

Vulnerability in packageCmd function leads to arbitrary code execution via filePath parameters

Source: GitHub Advisory Database (reviewed) Critical CVE-2020-36378

Packages

Ecosystem	Package	Affected	Fixed in
npm	aaptjs	<= 1.3.1	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

aaptjs is a node wraper for aapt. An issue was discovered in the packageCmd function in shenzhim aaptjs 1.3.1, allows attackers to execute arbitrary code via the filePath parameters.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-36378 advisory
https://github.com/shenzhim/aaptjs/issues/2 web
https://github.com/shenzhim/aaptjs package