Description

markdown-pdf version 11.0.0 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate the Markdown content entered by the user.

Remediation

References

https://fluidattacks.com/advisories/relsb/

https://www.npmjs.com/package/markdown-pdf/

Related Vulnerabilities

CVE-2022-39218 Vulnerability in npm package @fastly/js-compute

CVE-2020-7786 Vulnerability in npm package macfromip

CVE-2022-4348 Vulnerability in maven package com.ruoyi:ruoyi-common

CVE-2022-22984 Vulnerability in npm package snyk-gradle-plugin

CVE-2021-32684 Vulnerability in npm package magento-scripts

Severity

Critical

Classification

CWE-79 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

Tags

Exploit Third Party Advisory Product