Threats affecting pkg:npm/pdfmake

pdfmake versions from 0.3.0-beta.1 up to but not including 0.3.14 have a vulnerability involving shared resource caching. This flaw allows attackers to access cached resources across different documents by exploiting a process-wide virtual file system that keys only by URL, without enforcing request headers or per-document access controls. As a result, attackers can retrieve resources fetched with other users' credentials or from URLs that would normally be restricted by access policies, leading to cross-document information disclosure and bypass of URL access restrictions. The issue is fixed in version 0.3.14.

pdfmake versions 0.3.8 through 0.3.11 contain a vulnerability where the setLocalAccessPolicy() restriction is not enforced on images referenced inside SVG content. This flaw allows attackers to embed SVG images with href attributes that point to local file paths, potentially exposing restricted local files in generated PDFs. The issue is fixed in version 0.3.12.

Server-Side Request Forgery (SSRF) vulnerability in pdfmake versions 0.3.0-beta.2 through 0.3.5 allows a remote attacker to obtain sensitive information via the src/URLResolver.js component. The fix was released in version 0.3.6 which introduces the setUrlAccessPolicy() method allowing server operators to define URL access rules. A warning is now logged when pdfmake is used server-side without a policy configured.

An issue discovered in pdfmake 0.2.9 allows remote attackers to run arbitrary code via crafted POST request to the /pdf endpoint. NOTE: this is disputed because the behavior of the /pdf endpoint is intentional. The /pdf endpoint is only available after installing a test framework (that lives outside of the pdfmake applicaton). Anyone installing this is responsible for ensuring that it is only available to authorized testers.