Back
CVE-2018-3746
CRITICAL
The pdfinfojs NPM module versions <= 0.3.6 has a command injection vulnerability that allows an attacker to execute arbitrary commands on the victim's machine.
Published: Jun 1, 2018
Modified: Jun 17, 2026
CWE-77
CWE-78
CVSS Metrics
CVSSv3
Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products (1)
| Vendor | Product | Version |
|---|---|---|
| pdfinfojs_project | pdfinfojs | * |
GitHub Security Advisory GHSA-3pxp-6963-46r9
Command Injection in pdfinfojs
npm
pdfinfojs
< 0.4.1
Fixed: 0.4.1
References (2)
- https://hackerone.com/reports/330957 Exploit, Third Party Advisory
- https://hackerone.com/reports/330957 Exploit, Third Party Advisory
Risk Scores
CVSS Score
9.8 / 10
EPSS Score
4.93%
Top 9% most likely to be exploited
Threat Score
40.7 / 100
Data Sources
NVD
EPSS
GitHub