Moyenne
6.9
pdfmake 0.3.8 before 0.3.12 fails to apply the setLocalAccessPolicy() restriction to images...
CVE-2026-114491
Première détection SecPulse
Paquets affectés
| Écosystème | Paquet | Concernées | Corrigé |
|---|---|---|---|
| bpampuch | pdfmake |
≥ 0.3.8, < 0.3.12 |
0.3.12 |
Description d'origine La description telle que publiée par la source (souvent en anglais).
pdfmake 0.3.8 before 0.3.12 fails to apply the setLocalAccessPolicy() restriction to images referenced inside SVG content, allowing attackers to read blocked local files. Attackers supplying a document definition can add an SVG image href pointing to a local path, embedding restricted file contents in the generated PDF.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory