jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.2.1, user control of arguments of the `createAnnotation` method allows users to inject arbitrary PDF objects, such as JavaScript actions. If given the possibility to pass unsanitized input to the following method, a user can inject arbitrary PDF objects, such as JavaScript actions, which might trigger when the PDF is opened or interacted with the `createAnnotation`: `color` parameter. The vulnerability has been fixed in jsPDF@4.2.1. As a workaround, sanitize user input before passing it to the vulnerable API members.
oryginał ENCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:NParall Jspdf
APPParall< 4.2.1
Powiązane podatności
XSS w bibliotece jsPDF — wstrzyknięcie skryptów przez argument output()
Path traversal w jsPDF (Node.js) umożliwia odczyt dowolnych plików
jsPDF is a library to generate PDFs in JavaScript. Prior to 4.2.0, user control of properties and methods of t...
jsPDF is a library to generate PDFs in JavaScript. Prior to 4.2.0, user control of the first argument of the `...
jsPDF is a library to generate PDFs in JavaScript. Prior to 4.2.0, user control of the argument of the `addJS`...