First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2020-28464

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

This affects the package djv before 2.1.4. By controlling the schema file, an attacker can run arbitrary JavaScript code on the victim machine.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

Vendor	Product	Versions
n/a	djv	>= unspecified, < 2.1.4

References

https://github.com/korzio/djv/blob/master/lib/utils/properties.js%23L55Broken Link
https://github.com/korzio/djv/pull/98/filesPatch, Third Party Advisory
https://snyk.io/vuln/SNYK-JS-DJV-1014545Exploit, Third Party Advisory
https://github.com/korzio/djv/blob/master/lib/utils/properties.js%23L55Broken Link
https://github.com/korzio/djv/pull/98/filesPatch, Third Party Advisory
https://snyk.io/vuln/SNYK-JS-DJV-1014545Exploit, Third Party Advisory

Timeline

Published: Jan 4, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-284667.5This affects all versions of package github.com/nats-io/nats-server/server. Untrusted accounts are able to crash the server using configs th CVE-2020-284689.8This affects the package pwntools before 4.3.1. The shellcraft generator for affected versions of this module are vulnerable to Server-Side CVE-2020-284697.5This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separat CVE-2020-28478.2Vulnerability in the Oracle Depot Repair product of Oracle E-Business Suite (component: Estimate and Actual Charges). Supported versions tha CVE-2020-284706.1This affects the package @scullyio/scully before 1.0.9. The transfer state is serialised with the JSON.stringify() function and then written CVE-2020-284719.8This affects the package properties-reader before 2.2.0.CVE-2020-284729.8This affects the package @aws-sdk/shared-ini-file-loader before 1.0.0-rc.9; the package aws-sdk before 2.814.0. If an attacker submits a mal CVE-2020-284736.8The package bottle from 0 and before 0.12.19 are vulnerable to Web Cache Poisoning by using a vector called parameter cloaking. When the att CVE-2020-284777.5This affects all versions of package immer.CVE-2020-284787.5This affects the package gsap before 3.6.0.CVE-2020-284797.5The package jointjs before 3.3.0 are vulnerable to Denial of Service (DoS) via the unsetByPath function.CVE-2020-28488.2Vulnerability in the Oracle Depot Repair product of Oracle E-Business Suite (component: Estimate and Actual Charges). Supported versions tha