GHSA-3pxp-6963-46r9CriticalCVSS 9.8

Command Injection in pdfinfojs

Published
June 7, 2018
Last Modified
January 31, 2023

🔗 CVE IDs covered (1)

CVE-2018-3746 →

📋 Description

Versions of pdfinfojs before 0.4.1 are vulnerable to command injection. This is exploitable if an attacker can control the filename parameter that is passed into the pdfinfojs constructor.

Recommendation

Update to version 0.4.1 or later.

🎯 Affected products1

  • npm/pdfinfojs:< 0.4.1

🔗 References (5)