Critical · 9.8 CVE-2020-36381 EUVD-2021-2313GHSA-7fw7-gh23-f832

Vulnerability in singleCrunch function leads to arbitrary code execution via filePath parameters

Published Oct 31, 2021 · Updated Aug 4, 2024 · Assigned by mitre

Description

An issue was discovered in the singleCrunch function in shenzhim aaptjs 1.3.1, allows attackers to execute arbitrary code via the filePath parameters.

Affected packages

Ecosystem	Package	Affected	Fixed	Record
npm	aaptjs	<= 1.3.1	—	GHSA-7fw7-gh23-f832

References

https://github.com/shenzhim/aaptjs/issues/2