Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS1wM3J2LXFqNTYtMmZxeM4AA5YM
Cross-site Scripting in Pyhtml2pdf
Pyhtml2pdf version 0.0.6 allows an external attacker to remotely obtain
arbitrary local files. This is possible because the application does not
validate the HTML content entered by the user.
Permalink: https://github.com/advisories/GHSA-p3rv-qj56-2fqxJSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1wM3J2LXFqNTYtMmZxeM4AA5YM
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: 2 months ago
Updated: 2 months ago
CVSS Score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Identifiers: GHSA-p3rv-qj56-2fqx, CVE-2024-1647
References:
- https://nvd.nist.gov/vuln/detail/CVE-2024-1647
- https://fluidattacks.com/advisories/oliver
- https://github.com/advisories/GHSA-p3rv-qj56-2fqx
Affected Packages
pypi:pyhtml2pdf
Dependent packages: 1Dependent repositories: 5
Downloads: 23,043 last month
Affected Version Ranges: <= 0.0.6
No known fixed version
All affected versions: 0.0.1, 0.0.2, 0.0.3, 0.0.4, 0.0.5, 0.0.6