CVE-2022-46161

Katalog CVE

CVSS 9.8 · Critical EPSS 1,7%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada pdfmake. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

pdfmake is an open source client/server side PDF printing in pure JavaScript. In versions up to and including 0.2.5 pdfmake contains an unsafe evaluation of user controlled input. Users of pdfmake are thus subject to arbitrary code execution in the context of the process running the pdfmake code. There are no known fixes for this issue. Users are advised to restrict access to trusted user input.

Rincian

Terbit di NVD

6 Desember 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')

EPSS (30 hari)

1,7% peluang dieksploitasi; lebih tinggi dari 77,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/bpampuch/pdfmake/blob/802813970ac6de68a0bd0931b74150b33da0dd18/dev-playground/server.js#L32 exploit · advisory pihak ketiga
• https://securitylab.github.com/advisories/GHSL-2022-068_pdfmake/ exploit · advisory pihak ketiga