CVE-2020-7604: 
JavaScript vulnerability analysis and mitigation

A command injection vulnerability exists in pulverizr through version 0.7.0. Within the "lib/job.js" file, the variable "filename" can be controlled by an attacker and is used to construct the argument of an exec call without proper sanitization. To exploit this vulnerability, an attacker needs to create a new file with the same name as the attack command (NVD, Snyk).

The vulnerability exists in the lib/job.js file where the filename variable is used unsanitized in an exec call. The attack requires creating a file with a name matching the intended command to be executed. A proof of concept demonstrates exploitation by creating a file named '";touch Song;&a.jpg' which leads to command injection (Snyk).

Successful exploitation allows an attacker to execute arbitrary commands on the system where pulverizr is running. This could lead to complete system compromise depending on the privileges under which the application is running (Snyk).

There is no fixed version available for pulverizr. Users should consider using alternative image processing libraries with proper input sanitization (Snyk).