CVE-2022-25765

Katalog CVE

CVSS 9.8 · Critical EPSS 41,6%

Kerentanan pada pdfkit project pdfkit, fedoraproject fedora. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

The package pdfkit from 0.0.0 are vulnerable to Command Injection where the URL is not properly sanitized.

Rincian

Terbit di NVD

9 September 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

EPSS (30 hari)

41,6% peluang dieksploitasi; lebih tinggi dari 98,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/pdfkit/pdfkit/blob/46cdf53ec540da1a1a2e4da979e3e5fe2f92a257/lib/pdfkit/pdfkit.rb%23L55-L58 advisory pihak ketiga
• https://github.com/pdfkit/pdfkit/blob/master/lib/pdfkit/source.rb%23L44-L50 advisory pihak ketiga
• https://security.snyk.io/vuln/SNYK-RUBY-PDFKIT-2869795 exploit · advisory pihak ketiga
• http://packetstormsecurity.com/files/171746/pdfkit-0.8.7.2-Command-Injection.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C36GAV3TKM3JX...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ESWB6SX7HYWQ5...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JFB2BFKH5SUGR...