Description
A path traversal exists in markdown-pdf version <9.0.0 that allows a user to insert a malicious html code that can result in reading the local files.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| HackerOne | markdown-pdf | 9.0.0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | markdown-pdf | < 9.0.0 | 9.0.0 | GHSA-p7c9-jqhq-vr3v |