Executive brief
font-converter is a Node.js library that wraps FontForge to convert between font formats (TTF, WOFF, OTF). The library fails to sanitize user input passed to system commands, allowing attackers to inject arbitrary shell commands and achieve remote code execution on systems using the library.
Technical details
The vulnerability is a command injection flaw (CWE-77) caused by missing input sanitization in font-converter. User-controlled parameters are passed unsanitized to Node.js child_process.exec(), which executes shell commands directly. An attacker can inject shell metacharacters (e.g., $(command);#) through any of the function parameters to execute arbitrary commands with the privileges of the application. The attack requires only the ability to call the library's constructor; no authentication or user interaction is necessary. All versions up to and including 1.1.1 are affected, with no patch currently available in the advisory.
Affected products
- zgec font-converter all versions up to 1.1.1
Timeline
- 2022-08-29: disclosed
- 2022-08-29: other: CVE-2022-21165 assigned