Snyk Security Database

tailwindcss-uniform is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship.

xhtml2pdf is a PDF generator using HTML and CSS

Affected versions of this package are vulnerable to Command Injection in the startViewer function in xhtml2pdf/pisa.py, whose fallback path interpolates the file name into a shell string as os.system('open "%s"' % filename) after os.startfile raises. An attacker can execute arbitrary commands by supplying a file name such as x"; rm -rf ~; #.pdf, either as the destination the command line tool opens or as an argument passed directly, since the function is also public API.

Note: Only the command line tool is exploitable, and only when -s, --start-viewer, or --start is passed, the name comes from the -d destination or is derived from the source file name, the shell branch is reached only where os.startfile is unavailable rather than on Windows, the person invoking the tool already controls its arguments so no privilege boundary is crossed in ordinary use, exposure needs automation running the tool with -s over files an attacker can name, that flag opens a GUI viewer and is unusual for a server side job, and the library path through pisa.pisaDocument never reaches the function at all.

io.vertx:vertx-core is a tool-kit for building reactive applications on the JVM.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the WebSocket extension setup of HttpServerConnectionHandler and Http1ClientConnection, which construct the deflate-frame and permessage-deflate handshakers without a maximum allocation for the decompressor, so the configured frame and message size limits bound only the compressed bytes on the wire. An attacker can exhaust memory on the peer by sending a small compressed frame or message that expands to an arbitrarily larger payload during decompression. This requires compression to have been negotiated on the connection, and it applies in both roles, to a server accepting connections and to a client connecting to a server under the attacker's control.