Moole Vulnerability Database

Find real vulnerabilities before they ship

High

CVE-2024-1648

electron-pdf version 20.0.0 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate the HTML content entered by the user.

VectorNETWORK

PublishedFeb 20, 2024, 01:15

Published Byhelp@fluidattacks.com

Base Score

Score7.5

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

electron-pdf(npm)0N/AN/A

References

https://fluidattacks.com/advisories/drake
https://www.npmjs.com/package/electron-pdf/

Weakness Type

CWE-79

CVSS Metrics

Base Score

7.5

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Base SeverityHigh

Version

3.1

Attack Vector (AV)

NETWORK