GHSA-hcq6-h8v2-r5wm
Server-Side Request Forgery in node-pdf-generator
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | node-pdf-generator | <= 0.0.6 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
This affects all versions of package node-pdf-generator up to and including 0.0.6. Due to lack of user input validation and sanitization done to the content given to node-pdf-generator, it is possible for an attacker to craft a url that will be passed to an external server allowing an SSRF attack.
References
External links from the advisory. They lead to third-party sites.