Pdfmake
Monthly
pdfmake versions 0.3.0-beta.2 through 0.3.5 contain a server-side request forgery vulnerability in the URLResolver component that allows unauthenticated remote attackers to access sensitive information through crafted URL requests. Affected applications using vulnerable versions without proper URL access controls are at risk of information disclosure. No patch is currently available, though version 0.3.6 introduces URL access policy controls to mitigate the risk.
Unbounded HTTP redirect following in pdfmake's URLResolver crashes Node.js processes when attacker-controlled URLs trigger infinite redirect chains during file embedding. Affected are all 0.3.0 beta releases from beta.1 through beta.16 on both the npm and Java WebJars distributions. No special conditions beyond reaching a pdfmake rendering endpoint that accepts user-influenced document definitions are required; no public exploit code exists and the vulnerability is not in the CISA KEV catalog, but the attack mechanism is trivially reproducible.
An issue discovered in pdfmake 0.2.9 allows remote attackers to run arbitrary code via crafted POST request to the /pdf endpoint. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
pdfmake is an open source client/server side PDF printing in pure JavaScript. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
pdfmake versions 0.3.0-beta.2 through 0.3.5 contain a server-side request forgery vulnerability in the URLResolver component that allows unauthenticated remote attackers to access sensitive information through crafted URL requests. Affected applications using vulnerable versions without proper URL access controls are at risk of information disclosure. No patch is currently available, though version 0.3.6 introduces URL access policy controls to mitigate the risk.
Unbounded HTTP redirect following in pdfmake's URLResolver crashes Node.js processes when attacker-controlled URLs trigger infinite redirect chains during file embedding. Affected are all 0.3.0 beta releases from beta.1 through beta.16 on both the npm and Java WebJars distributions. No special conditions beyond reaching a pdfmake rendering endpoint that accepts user-influenced document definitions are required; no public exploit code exists and the vulnerability is not in the CISA KEV catalog, but the attack mechanism is trivially reproducible.
An issue discovered in pdfmake 0.2.9 allows remote attackers to run arbitrary code via crafted POST request to the /pdf endpoint. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
pdfmake is an open source client/server side PDF printing in pure JavaScript. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.