Executive brief
electron-pdf is a command-line tool and library used to convert HTML files and web pages into PDF documents. A security vulnerability in version 20.0.0 allows an attacker to craft malicious HTML content that, when processed, enables them to remotely read sensitive files from the local system. This could lead to the exposure of private data, configuration files, or system credentials.
Technical details
A Cross-Site Scripting (XSS) vulnerability exists in electron-pdf version 20.0.0 due to insufficient validation of user-supplied HTML content. By submitting specially crafted HTML to the PDF generation engine, a remote attacker can execute malicious scripts within the Electron environment. This execution context can be leveraged to bypass security boundaries and read arbitrary files from the local file system where the application is running. The vulnerability is triggered without requiring user interaction or authentication, provided the attacker can influence the HTML input processed by the tool.
Affected products
- fraserxu electron-pdf 20.0.0
Timeline
- 2024-02-19: disclosed: Vulnerability reported by Fluid Attacks
- 2024-02-20: advisory: NVD and GitHub Advisory published