high8.8
CVE-2021-45394
An issue was discovered in Spipu HTML2PDF before 5.2.4.
Impact
An issue was discovered in Spipu HTML2PDF before 5.2.4. Attackers can trigger deserialization of arbitrary data via the injection of a malicious <link> tag in the converted HTML document.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Html2pdf Project | Html2pdf | before 5.2.4 |
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/spipu/html2pdf
- https://github.com/spipu/html2pdf/blob/master/CHANGELOG.md
- https://www.synacktiv.com/sites/default/files/2022-01/html2pdf_ssrf_deserialization.pdf
- https://github.com/spipu/html2pdf
- https://github.com/spipu/html2pdf/blob/master/CHANGELOG.md
- https://www.synacktiv.com/sites/default/files/2022-01/html2pdf_ssrf_deserialization.pdf