Description
electron-pdf version 20.0.0 allows an external attacker to remotely obtain
arbitrary local files. This is possible because the application does not
validate the HTML content entered by the user.
Recommendation
No fix is available yet. Followings are affected versions:
- <= 20.0.0
References
Related Issues
- Bootstrap Cross-Site Scripting (XSS) vulnerability for data-* attributes - CVE-2024-6485
- Vditor allows Cross-site Scripting via an attribute of an `A` element - CVE-2024-34449
- VvvebJs Reflected Cross-Site Scripting (XSS) vulnerability - CVE-2024-29271
- Stored Cross-site Scripting (XSS) in excalidraw's web embed component - CVE-2024-32472
You might also like:
- Tags:
- npm
- electron-pdf
Anything's wrong? Let us know Last updated on March 20, 2026