CVE-2020-37282 is a critical (9.8) OS command injection in the office-converter npm package, all versions through 1.0.2. A crafted file name passed to generatePdf() or generateHtml() runs shell commands. The GitHub advisory lists no patched version, so replace the module or never pass it untrusted file names.
What's affected
The record lists office-converter through 1.0.2. The GitHub advisory GHSA-9p64-h5q4-phpm lists all versions as affected and states that there is no patched version. Its only advice is to consider an alternative module until a fix exists.
The vulnerable functions are generatePdf() and generateHtml(). The file name is placed in a command for unoconv that is run through child_process.exec(), so shell characters in the name are interpreted. Commands then run with the privileges of the Node.js process.
The CVSS vector is AV:N/AC:L/PR:N/UI:N, rated high for confidentiality, integrity and availability. Whether you are reachable depends on whether untrusted users can influence the file name.
How to check if you're exposed
Find the package in your projects.
npm ls office-converter --all
yarn why office-converter
pnpm why office-converter
Search your code for calls to generatePdf or generateHtml. Then trace where the file name argument comes from. If it can be set by an uploaded file name, a form field or an API parameter, you are exposed in the way the record describes. If the name is generated by your own code, the exposure is much lower.
You can also paste your lock file into the free scan at gold.safeguard.sh/scan to see whether the package is in your tree, including as a transitive dependency.
What to do now
- Run the commands above in every Node.js repository and container image you ship.
- If the package is present and file names come from users, take the feature offline or stop passing user supplied names to it.
- Replace office-converter with a maintained library, or call the converter with an argument list that avoids a shell, such as child_process.execFile, and generate your own safe temporary file names.
- Treat any server that ran the package with untrusted names as possibly compromised, and review process activity and credentials available to the Node.js process.
- Pin dependency monitoring so a future advisory for any package you use reaches you quickly.
Why it matters
The weakness is CWE-78, OS command injection. The module builds a shell command by joining text and passes it to exec(), which runs it through a shell. A file name that contains characters the shell treats as syntax can end the intended command and add another. The advisory describes this at the level of the vulnerable calls, and the repository links show the two lines where the command is assembled.
No patch exists, which changes the plan. You cannot wait for an upgrade. The package has to be removed, wrapped in strict input handling, or isolated. Reachability matters here more than usual, because a copy of the module that never sees untrusted names is a much smaller problem than one behind an upload form.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is there a fixed version?
No. The GitHub advisory states there is no patched version and suggests an alternative module.
Does a file name really reach a shell?
The record says the file name is joined into an unoconv command that runs through child_process.exec(), so yes, shell syntax in the name is interpreted.
Sources
Last reviewed: 19 October 2026.
