Arbitrary Code Execution Affecting exiftool-vendored.exe package, versions <12.25.0
Threat Intelligence
Exploit Maturity
Mature
EPSS
96.69% (100th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-EXIFTOOLVENDOREDEXE-1279040
- published 4 May 2021
- disclosed 4 May 2021
- credit Unknown
Introduced: 4 May 2021
CVE-2021-22204 Open this link in a new tabHow to fix?
Upgrade exiftool-vendored.exe to version 12.25.0 or higher.
Overview
exiftool-vendored.exe is a Provides the win32 distribution of ExifTool to node.
Affected versions of this package are vulnerable to Arbitrary Code Execution via the DjVu file format. Improper neutralization of user data allows arbitrary code execution when parsing a malicious image.
CVSS Scores
version 3.1