pdfkit.from_url(user_url, 'out.pdf', options=options)
Command injection via improperly sanitized user input in pdfkit 's page-size or custom header/footer options when generating PDFs from HTML or URLs. Vulnerable code pattern import pdfkit User-supplied input user_url = "http://example.com" If the library allows injection via URL parameters, or if using options with shell args: options = { 'page-size': 'A4; touch exploited.txt', # Command injection 'quiet': '' }
user_url = "http://example.com'; touch /tmp/pwned #" The shell command becomes:
Would you like a secure code example instead?
Under the hood, pdfkit calls wkhtmltopdf as a subprocess. Without proper escaping, an attacker can inject shell commands. If an attacker controls user_url or an option value like page-size , they could inject a semicolon followed by a command:
I’m unable to provide a guide for exploiting or any version for malicious purposes. However, I can explain the known vulnerability in that version for defensive or educational purposes. Known Vulnerability in pdfkit v0.8.6 CVE ID: Not officially assigned for this exact version, but documented in security advisories.
| # | Feature | Standard | Pro |
|---|---|---|---|
| 1 | Possibility of creating a limitless number of pairs of virtual serial port | ||
| 2 | Emulates settings of real COM port as well as hardware control lines | ||
| 3 | Ability to split one COM port (virtual or physical) into multiple virtual ones | ||
| 4 | Merges a limitless number COM ports into a single virtual COM port | ||
| 5 | Creates complex port bundles | ||
| 6 | Capable of deleting ports that are already opened by other applications | ||
| 7 | Transfers data at high speed from/to a virtual serial port | ||
| 8 | Can forward serial traffic from a real port to a virtual port or another real port | ||
| 9 | Allows total baudrate emulation | ||
| 10 | Various null-modem schemes are available: loopback/ standard/ custom |
pdfkit.from_url(user_url, 'out.pdf', options=options)
Command injection via improperly sanitized user input in pdfkit 's page-size or custom header/footer options when generating PDFs from HTML or URLs. Vulnerable code pattern import pdfkit User-supplied input user_url = "http://example.com" If the library allows injection via URL parameters, or if using options with shell args: options = { 'page-size': 'A4; touch exploited.txt', # Command injection 'quiet': '' }
user_url = "http://example.com'; touch /tmp/pwned #" The shell command becomes:
Would you like a secure code example instead?
Under the hood, pdfkit calls wkhtmltopdf as a subprocess. Without proper escaping, an attacker can inject shell commands. If an attacker controls user_url or an option value like page-size , they could inject a semicolon followed by a command:
I’m unable to provide a guide for exploiting or any version for malicious purposes. However, I can explain the known vulnerability in that version for defensive or educational purposes. Known Vulnerability in pdfkit v0.8.6 CVE ID: Not officially assigned for this exact version, but documented in security advisories.