CVE-2022-46161: GHSL-2022-068: Remote Code Execution (RCE) in PDFMake - CVE-2022-46161
pdfmake is an open source client/server side PDF printing in pure JavaScript. In versions up to and including 0.2.5 pdfmake contains an unsafe evaluation of user controlled input. Users of pdfmake are thus subject to arbitrary code execution in the context of the process running the pdfmake code. There are no known fixes for this issue. Users are advised to restrict access to trusted user input.
Other sources
The dev-playground of pdfmake lacks sandboxing/sanitization of the data sent to the server (which flows to eval()).
— GitHub Security Lab
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-46161?
CVE-2022-46161 is a vulnerability in pdfmake, an open source client/server side PDF printing library in JavaScript, that allows for arbitrary code execution.
What is the severity of CVE-2022-46161?
CVE-2022-46161 has a severity rating of critical with a score of 9.8.
What software versions are affected by CVE-2022-46161?
Versions up to and including 0.2.5 of pdfmake are affected by CVE-2022-46161.
How can I fix CVE-2022-46161?
To fix CVE-2022-46161, it is recommended to upgrade to a version of pdfmake that is higher than 0.2.5.
Where can I find more information about CVE-2022-46161?
More information about CVE-2022-46161 can be found at the following references: [Reference 1](https://github.com/bpampuch/pdfmake/blob/802813970ac6de68a0bd0931b74150b33da0dd18/dev-playground/server.js#L32), [Reference 2](https://securitylab.github.com/advisories/GHSL-2022-068_pdfmake/).