Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTNweHAtNjk2My00NnI5

Command Injection in pdfinfojs

Versions of pdfinfojs before 0.4.1 are vulnerable to command injection. This is exploitable if an attacker can control the filename parameter that is passed into the pdfinfojs constructor.

Recommendation

Update to version 0.4.1 or later.

Permalink: https://github.com/advisories/GHSA-3pxp-6963-46r9
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTNweHAtNjk2My00NnI5
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: over 6 years ago
Updated: almost 2 years ago


CVSS Score: 9.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Percentage: 0.07486
EPSS Percentile: 0.94074

Identifiers: GHSA-3pxp-6963-46r9, CVE-2018-3746
References: Repository: https://github.com/fagbokforlaget/pdfinfojs
Blast Radius: 9.4

Affected Packages

npm:pdfinfojs
Dependent packages: 4
Dependent repositories: 9
Downloads: 102 last month
Affected Version Ranges: < 0.4.1
Fixed in: 0.4.1
All affected versions: 0.1.0, 0.1.1, 0.2.0, 0.3.0, 0.3.1, 0.3.2, 0.3.3, 0.3.4, 0.3.5, 0.3.6, 0.4.0
All unaffected versions: 0.4.1, 0.5.0, 0.5.1, 0.5.2