CVE-2022-25765

2022-09-0905:15:07

snyk

web.nvd.nist.gov

138

cve-2022-25765

command injection

pdfkit

url sanitization

vulnerability

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.5

Confidence

High

EPSS

0.213

Percentile

96.5%

JSON

The package pdfkit from 0.0.0 are vulnerable to Command Injection where the URL is not properly sanitized.

Affected configurations

Nvd

Node

pdfkit_projectpdfkitRange0.0.0≥ruby

Node

fedoraprojectfedoraMatch35

fedoraprojectfedoraMatch36

fedoraprojectfedoraMatch37

VendorProductVersionCPE
pdfkit_projectpdfkit*cpe:2.3:a:pdfkit_project:pdfkit:*:*:*:*:*:ruby:*:*
fedoraprojectfedora35cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
fedoraprojectfedora36cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*
fedoraprojectfedora37cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
pdfkit_project	pdfkit	*	cpe:2.3:a:pdfkit_project:pdfkit::::::ruby::*
fedoraproject	fedora	35	cpe:2.3:o:fedoraproject:fedora:35:::::::*
fedoraproject	fedora	36	cpe:2.3:o:fedoraproject:fedora:36:::::::*
fedoraproject	fedora	37	cpe:2.3:o:fedoraproject:fedora:37:::::::*

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "pdfkit",
    "versions": [
      {
        "version": "0.0.0",
        "status": "affected",
        "lessThan": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]