GitHub Advisoryadvisory · npm

GHSA-3jcv-5f9p-2f2p Cross-site Scripting in electron-pdf

HIGH Published 2024-02-20 Modified 2024-02-21 Official page ↗
Aliases
CVE-2024-1648
Ecosystem
npm
Packages
electron-pdf
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-79
Reviewed
2024-02-21

Affected packages

• npm electron-pdf: <= 20.0.0 (no fix yet)

Description

electron-pdf version 20.0.0 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate the HTML content entered by the user.

Related

Alias · CVE (1)

  • CVE-2024-1648 electron-pdf version 20.0.0 allows an external attacker to remotely obtain arbitrary local files. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References