CVE-2020-7782

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

This affects all versions of package spritesheet-js. It depends on a vulnerable package platform-command. The injection point is located in line 32 in lib/generator.js, which is triggered by main entry of the package.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
n/a	spritesheet-js	< unspecified

References

https://github.com/krzysztof-o/spritesheet.js/blob/master/lib/generator.js%23L32Broken Link
https://snyk.io/vuln/SNYK-JS-SPRITESHEETJS-1048333Exploit, Third Party Advisory
https://www.npmjs.com/package/spritesheet-jsProduct, Third Party Advisory
https://github.com/krzysztof-o/spritesheet.js/blob/master/lib/generator.js%23L32Broken Link
https://snyk.io/vuln/SNYK-JS-SPRITESHEETJS-1048333Exploit, Third Party Advisory
https://www.npmjs.com/package/spritesheet-jsProduct, Third Party Advisory

Timeline

Published: Feb 8, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-77849.8This affects all versions of package ts-process-promises. The injection point is located in line 45 in main entry of package in lib/process-CVE-2020-77859.8This affects all versions of package node-ps. The injection point is located in line 72 in lib/index.js.CVE-2020-77869.8This affects all versions of package macfromip. The injection point is located in line 66 in macfromip.js.CVE-2020-77878.2This affects all versions of package react-adal. It is possible for a specially crafted JWT token and request URL can cause the nonce, sessi CVE-2020-77889.8This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they CVE-2020-77895.6This affects the package node-notifier before 9.0.0. It allows an attacker to run arbitrary commands on Linux machines due to the options pa CVE-2020-77905.3This affects the package spatie/browsershot from 0.0.0. By specifying a URL in the file:// protocol an attacker is able to include arbitrary CVE-2020-77917.5This affects the package i18n before 2.1.15. Vulnerability arises out of insufficient handling of erroneous language tags in src/i18n/Concre CVE-2020-77927.5This affects all versions of package mout. The deepFillIn function can be used to 'fill missing properties recursively', while the deepMixIn CVE-2020-77937.5The package ua-parser-js before 0.7.23 are vulnerable to Regular Expression Denial of Service (ReDoS) in multiple regexes (see linked commit CVE-2020-77949.8This affects all versions of package buns. The injection point is located in line 678 in index file lib/index.js in the exported function in CVE-2020-77959.8The package get-npm-package-version before 1.0.7 are vulnerable to Command Injection via main function in index.js.