Approved changes feed: RSS · Atom
cpe:2.3:a:pdfmake_project:pdfmake:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Pdfmake Project (8b98806e-e73c-5e00-ae70-692e60a3aefe) |
|---|---|
| Product | Pdfmake (5c21f7eb-1e95-5f01-9369-4d06b2afe3c5) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/bpampuch/pdfmake |
purl2cpe | 2026-06-01 10:14:44.048199 |
pkg:maven/org.webjars.bower/pdfmake |
purl2cpe | 2026-06-01 10:14:44.048200 |
pkg:npm/pdfmake |
purl2cpe | 2026-06-01 10:14:44.048202 |
pkg:sourceforge/pdfmake.mirror |
purl2cpe | 2026-06-01 10:14:44.048203 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-25180 |
vulnerable | 2026-06-08 06:31:22.582636 |
Details available
An issue discovered in pdfmake 0.2.9 allows remote attackers to run arbitrary code via crafted POST request to the /pdf endpoint. NOTE: this is disputed because the behavior of the /pdf endpoint is intentional. The /pdf endpoint is only available after installing a test framework (that lives outside of the pdfmake applicaton). Anyone installing this is responsible for ensuring that it is only available to authorized testers.
Published: 2024-02-29T00:00:00.000Z
Updated: 2024-08-26T19:31:26.533Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-46161 |
vulnerable | 2026-06-08 05:50:38.272514 |
Code injection in pdfmake
CRITICAL (10)
pdfmake is an open source client/server side PDF printing in pure JavaScript. In versions up to and including 0.2.5 pdfmake contains an unsafe evaluation of user controlled input. Users of pdfmake are thus subject to arbitrary code execution in the context of the process running the pdfmake code. There are no known fixes for this issue. Users are advised to restrict access to trusted user input.
Published: 2022-12-06T18:47:00.669Z
Updated: 2025-04-22T15:58:39.616Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.