CVE-2020-28447

9.8 criticalEPSS 1.3%

Critical (9.8) in xopen project xopen. EPSS 1.3% chance of exploitation in the next 30 days.

This affects all versions of package xopen. The injection point is located in line 14 in index.js in the exported function xopen(filepath)

Severity

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.3% chance of exploitation in the next 30 days; higher than 71% of CVEs (scores of 2026-10-31)
CWE: CWE-77
Published: 2022-07-25
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-74wf-cwjg-9cf2	npm	xopen	<=1.0.0	no fix published