search

alafr / SVG-to-PDFKit

Insert SVG into a PDF document created with PDFKit
MIT License
397 stars 111 forks source link

Withdrawn: Arbitrary Code Execution in static-eval #151

Open Vinod-Telang1 opened 2 years ago

Vinod-Telang1 commented 2 years ago

pdfmake ->SVG-to-PDFKit module having vulnerabilities with following error Withdrawn: Arbitrary Code Execution in static-eval

pdf-make

Team can you please check this, its occurring with latest version SVG-to-PDFKit i.e 0.1.8

Ref issue: https://github.com/bpampuch/pdfmake/issues/2342

liborm85 commented 2 years ago

pdfkit is defined in package.json, but is not used by svg-to-pdfkit: https://github.com/alafr/SVG-to-PDFKit/blob/f47005207f71a0d9c6b60939f0c8cb5a01917419/package.json#L11

pdfkit dependency could be removed and that will solve this issue.