~ / search / GHSA-rhwx-hjx2-x4qr

GHSA-rhwx-hjx2-x4qr

PDFKit vulnerable to Command Injection

Source: GitHub Advisory Database (reviewed) Critical CVE-2022-25765

Packages

EcosystemPackageAffectedFixed in
RubyGems pdfkit < 0.8.7.2 0.8.7.2

Details

As written in the advisory (Markdown source, shown as plain text).

The package pdfkit is vulnerable to Command Injection where the URL is not properly sanitized. Note: This issue was patched in 0.8.7.2, but the patch was discovered to be ineffective. The updated patch version is 0.8.7.2.

References

External links from the advisory. They lead to third-party sites.