Lack of input validation in pdf-image npm package version <= 2.0.0 may allow an attacker to run arbitrary code if PDF file path is constructed based on untrusted user input.
References:MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXJ2N3AtbW13cS14Njc0
Improper Input Validation and Code Injection in pdf-image
| Affected Packages | Affected Versions | Fixed Versions | |
|---|---|---|---|
| npm:pdf-image | <= 2.0.0 | No known fixed version | |
Affected Version RangesAll affected versions0.0.1, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.1.0, 2.0.0 |
|||