CVE-2020-28464

Katalog CVE

CVSS 9.8 · Critical EPSS 3,0%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada djv project djv. Skor CVSS 3.1 9.8 (Critical) menurut snyk.io.

Deskripsi (NVD)

This affects the package djv before 2.1.4. By controlling the schema file, an attacker can run arbitrary JavaScript code on the victim machine.

Rincian

Terbit di NVD

4 Januari 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber snyk.io
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')

EPSS (30 hari)

3,0% peluang dieksploitasi; lebih tinggi dari 87,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/korzio/djv/pull/98/files patch · advisory pihak ketiga
• https://snyk.io/vuln/SNYK-JS-DJV-1014545 exploit · advisory pihak ketiga
• https://github.com/korzio/djv/blob/master/lib/utils/properties.js%23L55 broken link