Paper/Archive/CVE-2022-25765

CVE-2022-25765

snyk — Command Injection

EPSS 42%CVSS 9.8

critical.is priorityof 100

49

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 98.7.987 × 2019.7 No public exploit+100.0 SSVC exploitation: unknown+100.0

Description · from the CVE record

The package pdfkit from 0.0.0 are vulnerable to Command Injection where the URL is not properly sanitized.

Affected

ProductAffectedFixed inSource

pdfkit0.0.0 – < unspecifiedunspecifiedCNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

snyk (CNA)7.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P

References

refsecurity.snyk.io/vuln/SNYK-RUBY-PDFKIT-2869795 refgithub.com/pdfkit/pdfkit/blob/master/lib/pdfkit/source.rb%23L44-L50 refgithub.com/pdfkit/pdfkit/blob/46cdf53ec540da1a1a2e4da979e3e5fe2f92a257/lib/pdfkit/pdfkit.rb%23L55-L58 advisorylists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JFB2BFKH5SUGRKXMY6PWRQNGKZML7GDT advisorylists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ESWB6SX7HYWQ54UGBGQOZ7G24O6RAOKD advisorylists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C36GAV3TKM3JXV6UVMLMTTDRCPKSNETQ refpacketstormsecurity.com/files/171746/pdfkit-0.8.7.2-Command-Injection.html