GitHub Advisoryadvisory · npm

GHSA-qghr-877h-f9jh markdown-pdf vulnerable to local file read via server side cross-site scripting (XSS)

HIGH Published 2023-04-05 Modified 2025-02-13 Official page ↗
Aliases
CVE-2023-0835
Ecosystem
npm
Packages
markdown-pdf
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-79
Reviewed
2023-04-05

Affected packages

• npm markdown-pdf: <= 11.0.0 (no fix yet)

Description

markdown-pdf version 11.0.0 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate the Markdown content entered by the user.

Related

Alias · CVE (1)

  • CVE-2023-0835 markdown-pdf version 11.0.0 allows an external attacker to remotely obtain arbitrary local files. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References