Vulnerability · Published Oct 12, 2026 · Assigned by VulnCheck

CVE-2020-37279easy-pdf-merge 0.1.0 through 0.2.6 OS Command Injection via merge function

High 8.1

In plain English

A high-severity OS command injection in easy-pdf-merge from karuppiah7890. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.9% (higher than 80% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)1.9%top 20.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

easy-pdf-merge 0.1.0 through 0.2.6 contains an OS command injection vulnerability that allows attackers to execute commands by injecting shell metacharacters into source paths, destination path, or maxHeap option. Attackers can supply file names or options containing double quotes, semicolons, $() or backticks, which child_process.exec() runs through a shell with the Node.js process privileges.

Affected products (as reported)

Vendor	Product	Versions
karuppiah7890	easy-pdf-merge	0.1.0 – through 0.2.6

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References

GitHub Pull Request #28 issue-tracking, patch
GitHub Pull Request #45 issue-tracking, patch
Vulnerable code in PDFMerger.js technical-description
https://github.com/karuppiah7890/easy-pdf-merge product
VulnCheck Advisory: easy-pdf-merge 0.1.0 through 0.2.6 OS Command Injection via merge function third-party-advisory