Threats tagged 'ghsa-cw47-gww7-39hm'

pdfmake versions prior to 0.3.14 have a vulnerability in their shared resource caching mechanism. This flaw allows attackers to access cached resources across different documents by exploiting a process-wide virtual file system keyed only by URL, without enforcing request headers or per-document access controls. As a result, attackers can retrieve resources fetched with other callers' credentials or access URLs that should be restricted by later document policies, leading to cross-document information disclosure and bypass of URL access restrictions.