CVE-2024-1648 – electron-pdf 20.0.0 - Local File Read via Server Side XSS

https://notcve.org/view.php?id=CVE-2024-1648

electron-pdf version 20.0.0 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate the HTML content entered by the user. electron-pdf versión 20.0.0 permite a un atacante externo obtener de forma remota archivos locales arbitrarios. Esto es posible porque la aplicación no valida el contenido HTML ingresado por el usuario. • https://fluidattacks.com/advisories/drake https://www.npmjs.com/package/electron-pdf • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •