GHSA-3jcv-5f9p-2f2p
Cross-site Scripting in electron-pdf
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | electron-pdf | <= 20.0.0 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
electron-pdf version 20.0.0 allows an external attacker to remotely obtain
arbitrary local files. This is possible because the application does not
validate the HTML content entered by the user.
References
External links from the advisory. They lead to third-party sites.