CVE-2024-1648CWE-79

electron-pdf 20.0.0 - Local File Read via Server Side XSS

High · published February 20, 2024

CVSS v3.1
7.5
EPSS
1%
Percentile
52.4
In the wild
Unconfirmed
What it is

electron-pdf version 20.0.0 allows an external attacker to remotely obtain

arbitrary local files. This is possible because the application does not

validate the HTML content entered by the user.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00695 · 52.4th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2024-02-20T00:01Z
EPSS history
Timeline
  • 20 FEB 00:01Z
    electron-pdf 20.0.0 - Local File Read via Server Side XSS
    cvelistv5