CVE-2018-3746

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The pdfinfojs NPM module versions <= 0.3.6 has a command injection vulnerability that allows an attacker to execute arbitrary commands on the victim's machine.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77 CWE-78

Affected software

Vendor	Product	Versions
HackerOne	pdfinfojs	<=0.3.6

References

https://hackerone.com/reports/330957Exploit, Third Party Advisory
https://hackerone.com/reports/330957Exploit, Third Party Advisory

Timeline

Published: Jun 1, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-37476.1The public node module versions <= 1.0.3 allows to embed HTML in file names, which (in certain conditions) might lead to execute malicious J CVE-2018-37486.1There is a Stored XSS vulnerability in the glance node module versions <= 3.0.5. File name, which contains malicious HTML (eg. embedded ifra CVE-2018-37499.8The utilities function in all versions < 1.0.1 of the deap node module can be tricked into modifying the prototype of Object when the attack CVE-2018-37509.8The utilities function in all versions <= 0.5.0 of the deep-extend node module can be tricked into modifying the prototype of Object when th CVE-2018-37519.8The utilities function in all versions <= 0.3.0 of the merge-recursive node module can be tricked into modifying the prototype of Object whe CVE-2018-37529.8The utilities function in all versions <= 1.0.0 of the merge-options node module can be tricked into modifying the prototype of Object when CVE-2018-37539.8The utilities function in all versions <= 1.0.0 of the merge-objects node module can be tricked into modifying the prototype of Object when CVE-2018-37548.8Node.js third-party module query-mysql versions 0.0.0, 0.0.1, and 0.0.2 are vulnerable to an SQL injection vulnerability due to lack of user CVE-2018-37556.1XSS in sexstatic <=0.6.2 causes HTML injection in directory name(s) leads to Stored XSS when malicious file is embed with <iframe> element u CVE-2018-37567.5Hyperledger Iroha versions v1.0_beta and v1.0.0_beta-1 are vulnerable to transaction and block signature verification bypass in the transact CVE-2018-37579.8Command injection exists in pdf-image v2.0.0 due to an unescaped string parameter.CVE-2018-37588.8Unrestricted file upload (RCE) in express-cart module before 1.1.7 allows a privileged user to gain access in the hosting machine.