CVE-2020-28464

9.8 criticalEPSS 3.0%

Critical (9.8) in djv project djv. EPSS 3.0% chance of exploitation in the next 30 days. Fixed in djv 2.1.4.

This affects the package djv before 2.1.4. By controlling the schema file, an attacker can run arbitrary JavaScript code on the victim machine.

Severity

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 3.0% chance of exploitation in the next 30 days; higher than 87% of CVEs (scores of 2026-10-31)
CWE: CWE-94
Published: 2021-01-04
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-4hv7-3q38-97m8	npm	djv	<2.1.4	2.1.4