Security readout for executives and security teams
Plain-English summary
CVE-2020-28437 is a critical command injection issue in the npm package heroku-env. Public data says all versions are affected, with the injection point in lib/get.js loaded by index.js. If this package is present in deployed code or build tooling, treat it as urgent until vendor guidance confirms a safe path.
Executive priority
Prioritize this as critical where heroku-env exists in production, CI, or deployment pipelines. The likely blast radius depends on actual package use, but the CVSS profile supports urgent inventory and remediation planning.
Technical view
The bundled CVE data describes command injection in heroku-env, affecting all versions, with the vulnerable code path in lib/get.js required by index.js. CVSS 3.1 is 9.4: network reachable, low complexity, no privileges, no user interaction, high confidentiality and integrity impact, and low availability impact.
Likely exposure
Exposure is likely limited to Node.js projects that include heroku-env directly or transitively, especially deployment or environment-management code. The bundle does not identify specific platforms, Heroku deployments, runtime versions, or downstream applications beyond the heroku-env package itself.
Exploitation context
The CVSS temporal metric includes proof-of-concept maturity, but the source bundle does not cite active exploitation. CISA KEV is false, so do not assume known exploitation in the wild from this evidence alone.
Researcher notes
Evidence is narrow but specific: package name, affected scope, and vulnerable file path are identified. The bundle does not provide exploit mechanics, fixed versions, or maintainer remediation details, so validation should focus on package presence and vendor-confirmed guidance.
Mitigation direction
- Inventory all projects for direct or transitive heroku-env usage.
- Check Snyk and package maintainer guidance for confirmed remediation.
- Remove or replace heroku-env where it is not required.
- Treat affected builds as high priority until a safe version or migration is confirmed.
- Review deployment tooling that imports index.js from heroku-env.
Validation and detection
- Search dependency manifests and lockfiles for heroku-env.
- Confirm whether production, CI, or deployment code imports the package.
- Map any affected applications to business-critical services.
- Verify remediation against vendor guidance before closing the finding.
- Retest dependency inventory after rebuilding lockfiles or replacing the package.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
Execution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2020-28437 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.4 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L/E:P/RL:O/RC:C
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L/E:P/RL:O/RC:C3.95.5Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
9.4CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L/E:P/RL:O/RC:C
Source materials
- CVE List V5 sourceCVE List V5
- https://security.snyk.io/vuln/SNYK-JS-HEROKUENV-1050432CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.