CVE-2020-28464

Remote Code Execution (RCE)

This affects the package djv before 2.1.4. By controlling the schema file, an attacker can run arbitrary JavaScript code on the victim machine.

Affected

djv

CVSS v3.1 SNYK

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C

EPSS

3.03% chance of exploitation in the next 30 days, 87th percentile

Published

2021-01-04

Updated

2024-09-17

Proof-of-concept exploits (1)

• https://snyk.io/vuln/SNYK-JS-DJV-1014545

Security advisories

• korzio/djv/pull/98/files
• advisories/GHSA-4hv7-3q38-97m8

References

• CVE Record
• NVD entry