GHSA-p7c9-jqhq-vr3v

Source

https://github.com/advisories/GHSA-p7c9-jqhq-vr3v

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/07/GHSA-p7c9-jqhq-vr3v/GHSA-p7c9-jqhq-vr3v.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-p7c9-jqhq-vr3v

Aliases

CVE-2018-3770

Published

2018-07-27T17:03:46Z

Modified

2023-11-08T04:00:19.571409Z

Severity

5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

Remote Code Execution in markdown-pdf

Details

Versions of markdown-pdf prior to 9.0.0 are vulnerable to Remote Code Execution. The package fails to sanitize HTML code in markdown files. If markdown files with malicious HTML are converted to PDF, the resulting PDF file will execute any JavaScript code in the original markdown file. This may allow attackers to execute Remote Code.

Recommendation

Upgrade to version 9.0.0 or later.

Database specific

{
    "cwe_ids": [
        "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-16T21:48:26Z",
    "nvd_published_at": "2018-07-20T22:29:00Z",
    "severity": "MODERATE"
}

References

Affected packages

npm / markdown-pdf

Package

Name: markdown-pdf; View open source insights on deps.dev
Purl: pkg:npm/markdown-pdf

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

9.0.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/07/GHSA-p7c9-jqhq-vr3v/GHSA-p7c9-jqhq-vr3v.json"