Pdfmake

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:bpampuch:pdfmake:*:*:*:*:*:*:*:*

part: a version: * update: *

VendorBpampuch (5fa8a703-d4f9-592e-9058-a9db4e01724b)
ProductPdfmake (be1b98bd-ace7-5cec-b542-b9155d54c349)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*

Notes

Imported from gcve-enriched-dumps CVE data

PURL mappings

PURLSourceLast updated
No PURL mappings for this CPE yet.

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2026-114491 vulnerable 2026-11-03 10:15:53.231534 pdfmake 0.3.8 before 0.3.12 Local File Policy Bypass via SVG Images
MEDIUM (5.3)
pdfmake 0.3.8 before 0.3.12 fails to apply the setLocalAccessPolicy() restriction to images referenced inside SVG content, allowing attackers to read blocked local files. Attackers supplying a document definition can add an SVG image href pointing to a local path, embedding restricted file contents in the generated PDF.
Published: 2026-10-21T17:54:16.217Z
Updated: 2026-10-28T17:31:25.430Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2022-46161 vulnerable 2026-06-08 05:50:38.271739 Code injection in pdfmake
CRITICAL (10)
pdfmake is an open source client/server side PDF printing in pure JavaScript. In versions up to and including 0.2.5 pdfmake contains an unsafe evaluation of user controlled input. Users of pdfmake are thus subject to arbitrary code execution in the context of the process running the pdfmake code. There are no known fixes for this issue. Users are advised to restrict access to trusted user input.
Published: 2022-12-06T18:47:00.669Z
Updated: 2025-04-22T15:58:39.616Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Inspect record JSON

Open JSON directly

Open this panel to browse, search, copy or download the JSON record.