GHSA-9cq3-fj2h-ggj5

Vulnerability in remove function leads to arbitrary code execution via filePath parameters

Source: GitHub Advisory Database (reviewed) Critical CVE-2020-36379

Packages

Ecosystem	Package	Affected	Fixed in
npm	aaptjs	<= 1.3.1	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Aaptjs is a node wraper for aapt. An issue was discovered in the remove function in shenzhim aaptjs 1.3.1, allows attackers to execute arbitrary code via the filePath parameters.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-36379 advisory
https://github.com/shenzhim/aaptjs/issues/2 web
https://github.com/shenzhim/aaptjs package