Advisory Weakness Curation

Server-Side Request Forgery in html-pdf-chrome ## Recommendation This package is working as intended. A Security https://github.com/westy92/html-pdf-chrome#security section has been added since v0.6.1 to detail proper usage of this library. Npm has revoked their advisory altogether. ## Original Advisory All versions of `html-pdf-chrome` are vulnerable to Server-Side Request Forgery (SSRF). The package executes HTTP requests if the parsed HTML contains external references to resources, such as `<iframe src="http://localhost" height="800px" width="800px"></iframe>`. This allows attackers to access resources through HTTP that are accessible to the server, including private resources in the hosting environment.

Server-Side Request Forgery in html-pdf-chrome All versions of `html-pdf-chrome` is vulnerable to Server-Side Request Forgery (SSRF). The package executes HTTP requests if the parsed HTML contains external references to resources, such as `<iframe src="http://localhost" height="800px" width="800px"></iframe>`. This allows attackers to access resources through HTTP that are accessible to the server, including private resources in the hosting environment. ## Recommendation No fix is currently available. Consider using an alternative package until a fix is made available.