CVE-2022-46161

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

pdfmake is an open source client/server side PDF printing in pure JavaScript. In versions up to and including 0.2.5 pdfmake contains an unsafe evaluation of user controlled input. Users of pdfmake are thus subject to arbitrary code execution in the context of the process running the pdfmake code. There are no known fixes for this issue. Users are advised to restrict access to trusted user input.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published: Dec 6, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-461629.8discourse-bbcode is the official BBCode plugin for Discourse. Prior to commit 91478f5, CSS injection can occur when rendering content genera CVE-2022-461637.5Travel support program is a rails app to support the travel support program of openSUSE (TSP). Sensitive user data (bank account details, pa CVE-2022-461649.8NodeBB is an open source Node.js based forum software. Due to a plain object with a prototype being used in socket.io message handling a spe CVE-2022-461655.4Syncthing is an open source, continuous file synchronization program. In versions prior to 1.23.5 a compromised instance with shared folders CVE-2022-461669.8Spring boot admins is an open source administrative user interface for management of spring boot applications. All users who run Spring Boot CVE-2022-461678.8Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to version 0.1.3, a ServiceAccount deployed in a Tenant Namespac CVE-2022-461683.5Discourse is an option source discussion platform. Prior to version 2.8.14 on the `stable` branch and version 2.9.0.beta15 on the `beta` and CVE-2022-461699.8Cacti is an open source platform which provides a robust and extensible operational monitoring and fault management framework for users. In CVE-2022-46176.1Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.3.2.CVE-2022-461709.8CodeIgniter is a PHP full-stack web framework. When an application uses (1) multiple session cookies (e.g., one for user pages and one for a CVE-2022-461717.7Tauri is a framework for building binaries for all major desktop platforms. The filesystem glob pattern wildcards `*`, `?`, and `[...]` matc CVE-2022-461726.4authentik is an open-source Identity provider focused on flexibility and versatility. In versions prior to 2022.10.4, and 2022.11.4, any aut