$ cve CVE-2020-28464 JSON

CVE-2020-28464

9.8

CRITICAL · CVSS 3.1 · EPSS 3% (pctl 87)

In your normal cycle

Critical by CVSS (9.8), but no sign of active exploitation.

This affects the package djv before 2.1.4. By controlling the schema file, an attacker can run arbitrary JavaScript code on the victim machine.

CVSS	9.8 (CRITICAL, v3.1)
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS	3.03% — more likely to be exploited than 87% of all CVEs
Weakness	CWE-94
On CISA KEV	no
Public exploit	none known
Published	2021-01-04
Last modified	2026-06-17

Vendor	Product
djv project	djv