CVE-2020-37279

Received Received - Intake

OS Command Injection in easy-pdf-merge

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description

easy-pdf-merge 0.1.0 through 0.2.6 contains an OS command injection vulnerability that allows attackers to execute commands by injecting shell metacharacters into source paths, destination path, or maxHeap option. Attackers can supply file names or options containing double quotes, semicolons, $() or backticks, which child_process.exec() runs through a shell with the Node.js process privileges.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2020-37279

Affected Vendors & Products

Vendor	Product	Version / Range
karuppiah7890	easy-pdf-merge	0.1.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

easy-pdf-merge versions 0.1.0 through 0.2.6 has an OS command injection flaw. Attackers can run arbitrary shell commands by inserting special characters like double quotes, semicolons, $() or backticks into file paths or options. The vulnerable function child_process.exec() processes these inputs through a shell using the Node.js process privileges.

Detection Guidance

To detect this vulnerability, inspect systems running easy-pdf-merge versions 0.1.0 through 0.2.6. Check for unusual command execution patterns or unexpected child processes spawned by Node.js. Look for files or options containing shell metacharacters like double quotes, semicolons, $() or backticks in source paths, destination paths, or maxHeap options.

Impact Analysis

If you use this software, attackers could execute malicious commands on your system with the same permissions as the Node.js process. This could lead to unauthorized file access, data theft, system compromise, or further network infiltration depending on the environment.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's integrity and confidentiality principles or HIPAA's safeguards for protected health information. Organizations may face compliance violations, fines, or legal consequences if exploited.

Mitigation Strategies

Immediately update easy-pdf-merge to a patched version beyond 0.2.6. If updating is not possible, restrict execution permissions for the application and monitor for suspicious activity. Avoid passing untrusted input to source paths, destination paths, or maxHeap options.

Hi! I’m here to help you understand CVE-2020-37279. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70