PT-2018-16188 · Npm · Markdown-Pdf

Published 2018-07-20 · Updated 2023-02-28 · CVE-2018-3770

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions markdown-pdf versions prior to 9.0.0

Description A path traversal issue in markdown-pdf allows users to insert malicious HTML code, potentially resulting in the reading of local files. The package fails to sanitize HTML code in markdown files, which can lead to Remote Code Execution when markdown files with malicious HTML are converted to PDF. This may allow attackers to execute remote code if the resulting PDF file contains JavaScript code from the original markdown file.

Recommendations For versions prior to 9.0.0, upgrade to version 9.0.0 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2018-3770

GHSA-P7C9-JQHQ-VR3V

Affected Products

Markdown-Pdf

References · 6

• 🔥 https://hackerone.com/reports/360727 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-3770 · Security Note
• https://osv.dev/vulnerability/CVE-2018-3770 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-p7c9-jqhq-vr3v · Vendor Advisory
• https://github.com/advisories/GHSA-p7c9-jqhq-vr3v · Note
• https://npmjs.com/advisories/991 · Note