MediumGHSA-pf6p-25r2-fx45CVE-2022-0085

Server-Side Request Forgery in dompdf/dompdf

Published 29 Jun 2022 · Updated 8 Nov 2023

Affected package

dompdf/dompdfComposer

Affected: <2.0.0
Fixed in: 2.0.0

Update to the fixed version for your release line, for example:composer require dompdf/dompdf:^2.0.0

Details

Server-Side Request Forgery (SSRF) in GitHub repository dompdf/dompdf prior to 2.0.0.

Is GHSA-pf6p-25r2-fx45 in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected dompdf/dompdf, and gives you the command that fixes it.

Scan a project free, no signup Or connect GitHub to scan every repo

References

Advisorynvd.nist.gov/vuln/detail/CVE-2022-0085
Linkgithub.com/dompdf/dompdf/commit/bb1ef65011a14730b7cfbe73506b4bb8a03704bd
Linkgithub.com/FriendsOfPHP/security-advisories/blob/master/dompdf/dompdf/CVE-2022-0085.yaml
Packagegithub.com/dompdf/dompdf
Linkhuntr.dev/bounties/73dbcc78-5ba9-492f-9133-13bbc9f31236

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.