CVE-2018-3770 Remote Code Execution in markdown-pdf
MediumCVSS 5.5
EPSS 0.50%
- Published
- Updated
- Exploit status
- No public exploit known
Description
A path traversal exists in markdown-pdf version <9.0.0 that allows a user to insert a malicious html code that can result in reading the local files.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| npm markdown-pdf(npm) | < 9.0.0 | 9.0.0 |
| markdown-pdf project markdown-pdf | < 9.0.0 | 9.0.0 |
| HackerOne markdown-pdf | = 9.0.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory
- hackerone.com exploit third-party-advisory
- github.com
- www.npmjs.com