PT-2022-27778 · Pdfmake · Pdfmake

Ryan Finn + 1 · Published 2022-12-06 · Updated 2025-10-20 · CVE-2022-46161

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions pdfmake versions up to and including 0.2.5

Description pdfmake contains an unsafe evaluation of user-controlled input, which can lead to arbitrary code execution in the context of the process running the pdfmake code. Users are advised to restrict access to trusted user input.

Recommendations For versions up to and including 0.2.5, restrict access to trusted user input as a temporary workaround to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2022-46161

Affected Products

Pdfmake

References · 9

• 🔥 https://github.com/bpampuch/pdfmake/blob/802813970ac6de68a0bd0931b74150b33da0dd18/dev-playground/server.js#L32 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/46xxx/CVE-2022-46161.json · Exploit
• 🔥 https://securitylab.github.com/advisories/GHSL-2022-068_pdfmake · Exploit
• https://osv.dev/vulnerability/CVE-2022-46161 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-46161 · Security Note
• https://t.me/cveNotify/139416 · Telegram Post
• https://t.me/cvenotify/39453 · Telegram Post
• https://t.me/cibsecurity/54100 · Telegram Post
• https://t.me/pentestingnews/30914 · Telegram Post