GHSA-qghr-877h-f9jh
markdown-pdf vulnerable to local file read via server side cross-site scripting (XSS)
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | markdown-pdf | <= 11.0.0 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
markdown-pdf version 11.0.0 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate the Markdown content entered by the user.
References
External links from the advisory. They lead to third-party sites.