GitHub Advisoryadvisory · npm

GHSA-rv7p-mmwq-x674 Improper Input Validation and Code Injection in pdf-image

HIGH Published 2021-05-10 Modified 2021-04-20 Official page ↗
Aliases
CVE-2020-8132
Ecosystem
npm
Packages
pdf-image
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-20, CWE-94
Reviewed
2021-04-20

Affected packages

• npm pdf-image: <= 2.0.0 (no fix yet)

Description

Lack of input validation in pdf-image npm package version &lt;= 2.0.0 may allow an attacker to run arbitrary code if PDF file path is constructed based on untrusted user input.

Related

Alias · CVE (1)

  • CVE-2020-8132 Lack of input validation in pdf-image npm package version <= 2.0.0 may allow an attacker to run arbitrary code if PDF file path is… vulnerability

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-94 Improper Control of Generation of Code weakness

References