GitHub Advisoryadvisory · npm

GHSA-5p98-wpc9-g498 Server-Side Request Forgery in html-pdf-chrome

HIGH Published 2020-09-04 Modified 2022-06-22 Official page ↗
Ecosystem
npm
Packages
html-pdf-chrome
Severity
High
Weaknesses
CWE-918
Reviewed
2020-08-31

Affected packages

• npm html-pdf-chrome: < 0.6.1 → fixed in 0.6.1

Description

Recommendation This package is working as intended. A Security section has been added since v0.6.1 to detail proper usage of this library. Npm has revoked their advisory altogether. Original Advisory All versions of `html-pdf-chrome` are vulnerable to Server-Side Request Forgery (SSRF). The package executes HTTP requests if the parsed HTML contains external references to resources, such as ``. This allows attackers to access resources through HTTP that are accessible to the server, including private resources in the hosting environment.

Related

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References