CVE-2020-37279: easy-pdf-merge 0.1.0 through 0.2.6 OS Command Injection via merge function

Q: Which application inputs can trigger the injection?

Treat every source path, the destination path, and the maxHeap option passed to the merge function as security-sensitive. Values containing shell metacharacters such as double quotes, semicolons, $(), or backticks can be interpreted by the shell.

Q: What must an attacker be able to do to exploit this?

An attacker must be able to supply or influence file names, paths, or the maxHeap option used by the merge function. The vulnerable code invokes child_process.exec(), which runs the constructed command through a shell.

Q: What level of access could successful exploitation provide?

Injected commands run with the privileges of the Node.js process. The resulting impact can include compromise of confidentiality, integrity, and availability available to that process.

Published Oct 12, 2026

Updated

easy-pdf-merge 0.1.0 through 0.2.6 contains an OS command injection vulnerability that allows attackers to execute commands by injecting shell metacharacters into source paths, destination path, or maxHeap option. Attackers can supply file names or options containing double quotes, semicolons, $() or backticks, which childprocess.exec() runs through a shell with the Node.js process privileges.

Affected Software

1 affected component

npm/easy-pdf-merge>=0.1.0<=0.2.6

Event History

Oct 12, 2026

CVE Published

via MITRE·08:55 PM

Data Sourced

via MITRE·08:55 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·09:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which application inputs can trigger the injection?

Treat every source path, the destination path, and the maxHeap option passed to the merge function as security-sensitive. Values containing shell metacharacters such as double quotes, semicolons, $(), or backticks can be interpreted by the shell.

What must an attacker be able to do to exploit this?

An attacker must be able to supply or influence file names, paths, or the maxHeap option used by the merge function. The vulnerable code invokes child_process.exec(), which runs the constructed command through a shell.

What level of access could successful exploitation provide?

Injected commands run with the privileges of the Node.js process. The resulting impact can include compromise of confidentiality, integrity, and availability available to that process.

CVE-2020-37279: easy-pdf-merge 0.1.0 through 0.2.6 OS Command Injection via merge function

Affected Software

Event History

Frequently Asked Questions

Which application inputs can trigger the injection?

What must an attacker be able to do to exploit this?

What level of access could successful exploitation provide?

Company

Resources

Contact

Frequently Asked Questions

Which application inputs can trigger the injection?

What must an attacker be able to do to exploit this?

What level of access could successful exploitation provide?