Arbitrary code execution in djv

심각 9.8CVE-2020-28464 · GHSA-4hv7-3q38-97m8 · Published 04/01/2021 · updated 17/06/2026

요약

Package	Affected versions	Patched versions
djv djv_project	`< 2.1.4`	`2.1.4`
djv npm	`< 2.1.4`	`2.1.4`

This affects the package djv before 2.1.4. By controlling the schema file, an attacker can run arbitrary JavaScript code on the victim machine.

NVD description

This affects the package djv before 2.1.4. By controlling the schema file, an attacker can run arbitrary JavaScript code on the victim machine.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.