HIGH7.5

GHSA-qghr-877h-f9jh

markdown-pdf vulnerable to local file read via server side cross-site scripting (XSS)

Details

markdown-pdf version 11.0.0 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate the Markdown content entered by the user.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/markdown-pdf

Introduced in: 0

No fixed version published yet for markdown-pdf (npm). Pin to a known-safe version or switch to an alternative.

References

https://nvd.nist.gov/vuln/detail/CVE-2023-0835[ADVISORY]
https://fluidattacks.com/advisories/relsb[WEB]
https://github.com/alanshaw/markdown-pdf[PACKAGE]
https://www.npmjs.com/package/markdown-pdf[WEB]