Description
A path traversal exists in markdown-pdf version <9.0.0 that allows a user to insert a malicious html code that can result in reading the local files.
Remediation
References
https://hackerone.com/reports/360727
Related Vulnerabilities
CVE-2022-39288 Vulnerability in npm package fastify
CVE-2022-25869 Vulnerability in maven package org.webjars.npm:angular
CVE-2022-44729 Vulnerability in maven package org.apache.xmlgraphics:batik-bridge
CVE-2020-26302 Vulnerability in maven package org.webjars.bower:is_js
CVE-2024-36401 Vulnerability in maven package org.geoserver:gs-wfs