8.7
CVSS 4.0
Няма данни
Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)
Няма потвърждение
Атакува се
Няма данни
Време до експлоатация
Атакува се по мрежата, без особени условия, без вход и след действие от потребителя.
- Експлоатация: има публичен пример за експлоатация
- Атаката не може да се автоматизира
Описание
Оригинално описание
html2pdf.js converts any webpage or element into a printable PDF entirely client-side. Prior to 0.14.0, html2pdf.js contains a cross-site scripting (XSS) vulnerability when given a text source rather than an element. This text is not sufficiently sanitized before being attached to the DOM, allowing malicious scripts to be run on the client browser and risking the confidentiality, integrity, and availability of the page's data. This vulnerability has been fixed in [email protected].
Засегнати продукти
- eKoopmans html2pdf.js: < 0.14.0
Вид слабост
История
- 14 януари 2026 Публикувано
Първоизточници
- https://www.cve.org/CVERecord?id=CVE-2026-22787
- https://nvd.nist.gov/vuln/detail/CVE-2026-22787
- https://github.com/eKoopmans/html2pdf.js/security/advisories/GHSA-w8x4-x68c-m6fc
- https://github.com/eKoopmans/html2pdf.js/issues/865
- https://github.com/eKoopmans/html2pdf.js/pull/877
- https://github.com/eKoopmans/html2pdf.js/commit/988826e336035b39a8608182d7b73c0e3cd78c7b
- https://github.com/eKoopmans/html2pdf.js/releases/tag/v0.14.0
- https://aydinnyunus.github.io/2026/01/17/cve-2026-22787-html2pdf-xss-vulnerability/