CVE-2020-28429: geojson2kml command injection via index.js

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityCritical CVSS 9.8 and very high EPSS with a public exploit, but exploitation requires a calling application that passes untrusted input to the package, so it is not automatically critical everywhere.

What it is

All versions of the npm package geojson2kml pass unsanitised input into a shell command in index.js, allowing OS command injection. The flaw is trivially reachable from application code that calls the package with attacker-influenced arguments, and no fixed version is identified in the record.

Impact

An attacker who controls the argument passed to the package can execute arbitrary operating system commands with the privileges of the Node.js process, leading to full compromise of confidentiality, integrity and availability.

Attack surface

Reached over the network through any application that feeds untrusted input into geojson2kml; the CVSS vector shows no privileges or user interaction required, though real-world reachability depends on how the calling application exposes the input.

Exploitation

Not listed in CISA KEV, but EPSS is 0.633 (99.2nd percentile) and the Snyk reference is tagged Exploit, indicating public proof-of-concept code exists.

What to do

• Upgrade or replace geojson2kml; the record names no fixed version, so verify with the maintainer or Snyk advisory before relying on a release.
• If no fix is available, stop passing untrusted input into the package and wrap or fork it to use execFile/spawn with argument arrays instead of a shell.
• Run Node.js services that use this package with least privilege and in a sandbox or container to limit command execution impact.
• Remove the dependency from builds where it is unused and add it to a dependency-block list.
• Monitor the Snyk advisory page for a patched release and track the dependency in your SBOM.

Detection

• Search source and lockfiles for geojson2kml usage and trace whether any caller argument is attacker-controlled.
• Alert on child_process or shell activity spawned by Node.js processes that load geojson2kml.
• Monitor for unexpected outbound connections or file writes from the Node.js service account following geojson2kml calls.
• Review application logs for shell metacharacters (;, &, |, $()) in inputs reaching geojson conversion endpoints.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.