{"id":"CVE-2022-21165","aliases":["EUVD-2022-6555","GHSA-g2c3-vwff-m3xr"],"status":"published","title":"Arbitrary Command Injection","description":"All versions of package font-converter are vulnerable to Arbitrary Command Injection due to missing sanitization of input that potentially flows into the child_process.exec() function.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.03072,"percentile":0.87745,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-77"],"published":"2022-08-29T05:00:17Z","modified":"2026-06-17T04:25:39Z","affected":[{"source":"ghsa","ecosystem":"npm","package":"font-converter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.1.1"}]}]},{"source":"osv","ecosystem":"npm","package":"font-converter","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"1.1.1"}]}]}],"products":[{"vendor":"font_converter_project","product":"font_converter"}],"references":[{"url":"https://security.snyk.io/vuln/SNYK-JS-FONTCONVERTER-2976194","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","web"]},{"url":"https://github.com/zgec/node-js-font-converter/blob/master/index.js%23L12","tags":["x_refsource_MISC","x_transferred","Broken Link","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-21165","tags":["advisory"]},{"url":"https://github.com/zgec/node-js-font-converter/blob/master/index.js#L12","tags":["web"]},{"url":"https://github.com/advisories/GHSA-g2c3-vwff-m3xr"},{"url":"https://github.com/zgec/node-js-font-converter","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2022-21165","title":"Arbitrary Command Injection","description":"All versions of package font-converter are vulnerable to Arbitrary Command Injection due to missing sanitization of input that potentially flows into the child_process.exec() function.","status":"published","published":"2022-08-29T05:00:17.008Z","modified":"2024-09-17T04:15:11.135Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"updated_at":"2026-11-02T14:34:29.057251Z"}],"euvd":[{"id":"EUVD-2022-6555","description":"All versions of package font-converter are vulnerable to Arbitrary Command Injection due to missing sanitization of input that potentially flows into the child_process.exec() function.","status":"published","published":"2022-08-29T05:00:17Z","modified":"2024-09-17T04:15:11Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T00:28:24.323088Z"}],"ghsa":[{"id":"GHSA-g2c3-vwff-m3xr","title":"Font-Converter Vulnerable to Arbitrary Command Injection","description":"### Overview\nfont-converter is a FontForge wrapper that allows conversion between different font formats (TTF, WOFF, OTF)\n\nAll versions of this package are vulnerable to Arbitrary Command Injection due to missing sanitization of input that potentially flows into the `child_process.exec()` function.\n\n### PoC\n```js\nvar PUT = require('font-converter');\nvar x = \"$(touch success);# \";\ntry {\n    new PUT(x, x, x, x);\n} catch (e) {\n    console.log(e);\n}\n```","status":"published","published":"2022-08-29T20:06:54Z","modified":"2024-04-22T23:17:13Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:37:44.335614Z"}],"nvd":[{"id":"CVE-2022-21165","description":"All versions of package font-converter are vulnerable to Arbitrary Command Injection due to missing sanitization of input that potentially flows into the child_process.exec() function.","status":"published","published":"2022-08-29T05:15:08.137Z","modified":"2026-06-17T04:25:39.643Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"updated_at":"2026-11-02T14:07:25.883929Z"}],"osv":[{"id":"GHSA-g2c3-vwff-m3xr","title":"Font-Converter Vulnerable to Arbitrary Command Injection","description":"### Overview\nfont-converter is a FontForge wrapper that allows conversion between different font formats (TTF, WOFF, OTF)\n\nAll versions of this package are vulnerable to Arbitrary Command Injection due to missing sanitization of input that potentially flows into the `child_process.exec()` function.\n\n### PoC\n```js\nvar PUT = require('font-converter');\nvar x = \"$(touch success);# \";\ntry {\n    new PUT(x, x, x, x);\n} catch (e) {\n    console.log(e);\n}\n```","status":"published","published":"2022-08-29T20:06:54Z","modified":"2024-04-22T23:44:02.873117Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T15:46:47.119724Z"}]}}