Description

The html-pdf package 2.2.0 for Node.js has an arbitrary file read vulnerability via an HTML file that uses XMLHttpRequest to access a file:/// URL.

Remediation

References

https://www.npmjs.com/advisories/1095

https://security.netapp.com/advisory/ntap-20191017-0005/

Related Vulnerabilities

CVE-2019-11002 Vulnerability in npm package materialize-css

CVE-2020-7672 Vulnerability in npm package mosc

CVE-2022-41936 Vulnerability in maven package org.xwiki.platform:xwiki-platform-rest-server

CVE-2021-21266 Vulnerability in maven package org.openhab.addons.bundles:org.openhab.binding.yamahareceiver

CVE-2023-29003 Vulnerability in npm package @sveltejs/kit

Severity

High

Classification

CWE-668 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Exploit Third Party Advisory