CVE-2020-7691 Security Vulnerability Issue

Question

CVE-2020-7691 Security Vulnerability Issue

parithibang opened this issue 8 months ago · 2 comments

With the latest version of jspdf:2.5.1 integrated into the project getting security vulnerability issue

CVE-2020-7691 EPSS: 0.17%CVSS: 6.1
In all versions of the package jspdf, it is possible to use <<script>script> in order to go over the filtering regex.

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7691
https://nvd.nist.gov/vuln/detail/CVE-2020-7691

Will there be a fix for this provided?

Answer 1 · 2024-02-06T13:05:46.000Z

Could you give us some steer on this @eKoopmans

Answer 2 · 2024-02-07T03:41:55.000Z

Thanks for the heads up!

The good news is that the fromHTML method reported in CVE-2020-7691 no longer exists in jsPDF:

It was deprecated in 2018 and removed sometime after that
It's not defined on a jsPDF object
The replacement html method is actually just a clone of htmlpdf.js (fun with recursion 🙃)

Even if that method did still exist in jsPDF, we only use the methods addPage, addImage, output, and save.

I think this should be safe to close.