~ / search / GHSA-rv7p-mmwq-x674

GHSA-rv7p-mmwq-x674

Improper Input Validation and Code Injection in pdf-image

Source: GitHub Advisory Database (reviewed) High CVE-2020-8132

Packages

EcosystemPackageAffectedFixed in
npm pdf-image <= 2.0.0 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Lack of input validation in pdf-image npm package version &lt;= 2.0.0 may allow an attacker to run arbitrary code if PDF file path is constructed based on untrusted user input.

References

External links from the advisory. They lead to third-party sites.