TI-2020-20046 CVE-2020-37282 · GHSA-869r-fxq2-q8qxOS Command Injection in office-converter via fileNamePriority HIGH 81office-converter through 1.0.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying a crafted fileName to generatePdf() or generateHtml().CVSS 4.0CRITICAL 9.3· Network · No auth · No interaction · EPSS 0.03446 · Published 2026-10-14 · No fix listed CWE-78