GHSA-6m93-343m-3jrc

Cross-site Scripting in HTML2PDF

Source: GitHub Advisory Database (reviewed) High CVE-2021-45394

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	spipu/html2pdf	< 5.2.4	5.2.4

Details

As written in the advisory (Markdown source, shown as plain text).

An issue was discovered in Spipu HTML2PDF before 5.2.4. Attackers can trigger deserialization of arbitrary data via the injection of a malicious <link> tag in the converted HTML document.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-45394 advisory
https://github.com/spipu/html2pdf/commit/100a4d509abf8550765cf0e0da83e83abb422585 web
https://github.com/spipu/html2pdf/commit/2e6bab9a2afe9cfd4d3c3038da64d8ad74e41d7f web
https://github.com/spipu/html2pdf package
https://github.com/spipu/html2pdf/blob/master/CHANGELOG.md web
https://github.com/spipu/html2pdf/releases/tag/v5.2.4 web
https://www.synacktiv.com/sites/default/files/2022-01/html2pdf_ssrf_deserialization.pdf web