GitHub Advisoryadvisory · PyPI

GHSA-p3rv-qj56-2fqx Cross-site Scripting in Pyhtml2pdf

HIGH Published 2024-02-20 Modified 2026-06-08 Official page ↗
Aliases
CVE-2024-1647
Ecosystem
PyPI
Packages
pyhtml2pdf
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-79
Reviewed
2024-02-21

Affected packages

• PyPI pyhtml2pdf: <= 0.0.6 (no fix yet)

Description

Pyhtml2pdf version 0.0.6 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate the HTML content entered by the user.

Related

Alias · CVE (1)

  • CVE-2024-1647 Pyhtml2pdf version 0.0.6 allows an external attacker to remotely obtain arbitrary local files. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References