CVE-2020-7749

HighCVSS 7.6/10Last modified Jun 17, 2026

Description

This affects all versions of package osm-static-maps. User input given to the package is passed directly to a template without escaping ({{{ ... }}}). As such, it is possible for an attacker to inject arbitrary HTML/JS code and depending on the context. It will be outputted as an HTML on the page which gives opportunity for XSS or rendered on the server (puppeteer) which also gives opportunity for SSRF and Local File Read.

Metrics

CVSS 3.1 7.6/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

Weakness enumeration

CWE-74 CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Oct 20, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-77509.6This affects the package scratch-svg-renderer before 0.2.0-prerelease.20201019174008. The loadString function does not escape SVG properly, CVE-2020-77517.2pathval before version 1.1.1 is vulnerable to prototype pollution.CVE-2020-77528.8This affects the package systeminformation before 4.27.11. This package is vulnerable to Command Injection. The attacker can concatenate cur CVE-2020-77537.5All versions of package trim are vulnerable to Regular Expression Denial of Service (ReDoS) via trim().CVE-2020-77547.5This affects the package npm-user-validate before 1.0.1. The regex that validates user emails took exponentially longer to process long inpu CVE-2020-77557.5All versions of package dat.gui are vulnerable to Regular Expression Denial of Service (ReDoS) via specifically crafted rgb and rgba values.CVE-2020-77576.5This affects all versions of package droppy. It is possible to traverse directories to fetch configuration files from a droopy server.CVE-2020-77587.5This affects versions of package browserless-chrome before 1.40.2-chrome-stable. User input flowing from the workspace endpoint gets used to CVE-2020-77597.2The package pimcore/pimcore from 6.7.2 and before 6.8.3 are vulnerable to SQL Injection in data classification functionality in Classificati CVE-2020-77607.5This affects the package codemirror before 5.58.2; the package org.apache.marmotta.webjars:codemirror before 5.58.2. The vulnerable regular CVE-2020-77615.3This affects the package @absolunet/kafe before 3.2.10. It allows cause a denial of service when validating crafted invalid emails.CVE-2020-77626.5This affects the package jsreport-chrome-pdf before 1.10.0.