GHSA-r496-7hgp-53wf

Vulnerability in dump function leads to arbitrary code execution via filePath parameters

Source: GitHub Advisory Database (reviewed) Critical CVE-2020-36377

Packages

Ecosystem	Package	Affected	Fixed in
npm	aaptjs	<= 1.3.1	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

aaptjs is a node wraper for aapt. An issue was discovered in the dump function in shenzhim aaptjs 1.3.1, allows attackers to execute arbitrary code via the filePath parameters.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-36377 advisory
https://github.com/shenzhim/aaptjs/issues/2 web
https://github.com/shenzhim/aaptjs package