Vulnerabilities

 1 via 1 paths

Dependencies

 222

Source

 GitHub

Find, fix and prevent vulnerabilities in your code.

Test and protect my applications
Severity
  • 1
Status
  • 1
  • 0
  • 0

medium severity
new

External Control of File Name or Path

  • Vulnerable module: pdfmake
  • Introduced through: pdfmake@0.3.11

Detailed paths

  • Introduced through: rtl@Ride-The-Lightning/RTL › pdfmake@0.3.11
    Remediation: Upgrade to pdfmake@0.3.12.

Overview

pdfmake is a Client/server side PDF printing in pure JavaScript

Affected versions of this package are vulnerable to External Control of File Name or Path via the SVG rendering path in src/Renderer.js, where local images embedded within SVG content bypass the setLocalAccessPolicy restriction. An attacker who can supply SVG content containing embedded local image references can read local files that the policy is intended to prohibit.

Remediation

Upgrade pdfmake to version 0.3.12 or higher.

References

External Control of File Name or Path vulnerability report