GHSA-m7p2-ghfh-pjvx

Vulnerability in crunch function leads to arbitrary code execution via filePath parameters

Source: GitHub Advisory Database (reviewed) Critical CVE-2020-36380

Packages

Ecosystem	Package	Affected	Fixed in
npm	aaptjs	<= 1.3.1	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

aaptjs is a node wraper for aapt. An issue was discovered in the crunch function in shenzhim aaptjs 1.3.1, allows attackers to execute arbitrary code via the filePath parameters.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-36380 advisory
https://github.com/shenzhim/aaptjs/issues/2 web
https://github.com/shenzhim/aaptjs package