What is GHSA-rv7p-mmwq-x674?

GHSA-rv7p-mmwq-x674 is a security advisory published by GitHub Security Advisories with High severity. Improper Input Validation and Code Injection in pdf-image

Which CVE IDs does GHSA-rv7p-mmwq-x674 cover?

GHSA-rv7p-mmwq-x674 covers the following CVE IDs: CVE-2020-8132. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-rv7p-mmwq-x674?

GHSA-rv7p-mmwq-x674 has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-rv7p-mmwq-x674?

GHSA-rv7p-mmwq-x674 affects 1 product, including: npm/pdf-image:\u003c= 2.0.0.

GHSA-rv7p-mmwq-x674HighCVSS 9.8

Improper Input Validation and Code Injection in pdf-image

Vendor

GitHub Security Advisories

Published

May 10, 2021

Last Modified

February 1, 2023

🔗 CVE IDs covered (1)

CVE-2020-8132 →

📋 Description

Lack of input validation in pdf-image npm package version <= 2.0.0 may allow an attacker to run arbitrary code if PDF file path is constructed based on untrusted user input.

🎯 Affected products1

npm/pdf-image:<= 2.0.0

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2020-8132
https://hackerone.com/reports/781664
https://github.com/advisories/GHSA-rv7p-mmwq-x674