CVE-2022-46161: bpampuch pdfmake Code Injection

Vulnerability summary

CVE-2022-46161 is a critical (CVSS 10.0) Code Injection vulnerability in bpampuch pdfmake. EPSS estimates a 1.73% chance of exploitation in the next 30 days, higher than 77.2% of scored vulnerabilities. 2 public exploits are recorded.

Timeline

1. 06-12-2022
   PublishedVulnerability first disclosed.
2. 22-04-2025
   Last modifiedVulnerability information updated.

Description

pdfmake is an open source client/server side PDF printing in pure JavaScript. In versions up to and including 0.2.5 pdfmake contains an unsafe evaluation of user controlled input. Users of pdfmake are thus subject to arbitrary code execution in the context of the process running the pdfmake code. There are no known fixes for this issue. Users are advised to restrict access to trusted user input.

• CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.