CVE-2020-37282 in office-converter
Summary
by MITRE • 10/14/2026
office-converter through 1.0.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying a crafted fileName to generatePdf() or generateHtml(). Attackers can embed $(...), backticks, or a closing quote with shell metacharacters in the file name, which is concatenated into an unoconv command run via child_process.exec(), executing commands with Node.js process privileges.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/14/2026
The vulnerability identified in office-converter versions through 1.0.2 represents a critical OS Command Injection flaw rooted in improper neutralization of special elements used in operating system commands. This security defect allows remote attackers to execute arbitrary system-level commands by manipulating the fileName parameter within the generatePdf() or generateHtml() functions. The root cause lies in how the library constructs shell commands for conversion tasks, specifically relying on child_process.exec(), which invokes a command interpreter such as /bin/sh or cmd.exe rather than executing binaries directly with arguments. This architectural choice introduces significant risk when input data is not rigorously sanitized before being concatenated into the command string.
Attackers can exploit this vulnerability by embedding shell metacharacters, subshell execution syntax like $(...), backticks, or closing quotes within the file name provided to the conversion functions. When these crafted inputs are processed, they break out of the intended argument boundaries and inject additional commands that are interpreted by the underlying operating system shell. Because child_process.exec() runs with the privileges of the Node.js process executing it, successful exploitation grants the attacker a high level of control over the host environment, potentially leading to full system compromise depending on the permissions under which the application is running.
The operational impact of this vulnerability extends beyond simple command execution. An adversary could use this access to exfiltrate sensitive data stored on the server, install malware or backdoors for persistent access, pivot into other internal network segments if the compromised host has broader connectivity, or disrupt service availability by terminating critical processes or corrupting system files. In cloud-native environments where office-converter might be deployed as a microservice, this could lead to container escape scenarios if not properly isolated via security contexts and resource limits.
This flaw aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command commonly known as OS Command Injection. From the perspective of the MITRE ATT&CK framework, it maps to T1059 Command and Scripting Interpreter, specifically subcategories involving shell commands or system scripts. The vulnerability is particularly dangerous because it does not require authentication if the input vector is exposed via a web interface or API endpoint that accepts file names for conversion tasks without adequate validation.
Mitigation strategies must prioritize immediate patching to version 1.0.3 or later where this issue has been addressed by developers through improved input sanitization and safer execution methods. In the interim, organizations should implement strict allowlisting of characters permitted in file names, rejecting any input containing shell metacharacters such as semicolons, pipes, ampersands, dollar signs, backticks, or parentheses. Additionally, replacing child_process.exec() with child_process.spawn() is recommended for future development, as spawn does not invoke a command interpreter and thus prevents the injection of arbitrary commands through argument manipulation. Running the Node.js process with minimal required privileges using principles of least privilege further reduces the blast radius in case an exploit occurs.