GHSA-5p98-wpc9-g498
Server-Side Request Forgery in html-pdf-chrome
Recommendation
This package is working as intended. A Security section has been added since v0.6.1 to detail proper usage of this library. Npm has revoked their advisory altogether.
Original Advisory
All versions of html-pdf-chrome are vulnerable to Server-Side Request Forgery (SSRF). The package executes HTTP requests if the parsed HTML contains external references to resources, such as <iframe src="http://localhost" height="800px" width="800px"></iframe>. This allows attackers to access resources through HTTP that are accessible to the server, including private resources in the hosting environment.
What each source reports
GitHub AdvisoriesNo score
Server-Side Request Forgery in html-pdf-chrome
Recommendation
This package is working as intended. A Security section has been added since v0.6.1 to detail proper usage of this library. Npm has revoked their advisory altogether.
Original Advisory
All versions of html-pdf-chrome are vulnerable to Server-Side Request Forgery (SSRF). The package executes HTTP requests if the parsed HTML contains external references to resources, such as <iframe src="http://localhost" height="800px" width="800px"></iframe>. This allows attackers to access resources through HTTP that are accessible to the server, including private resources in the hosting environment.
- Record
GHSA-5p98-wpc9-g498- Weakness
- CWE-918
- Updated
- 2026-11-02
OSVNo score
Server-Side Request Forgery in html-pdf-chrome
Recommendation
This package is working as intended. A Security section has been added since v0.6.1 to detail proper usage of this library. Npm has revoked their advisory altogether.
Original Advisory
All versions of html-pdf-chrome are vulnerable to Server-Side Request Forgery (SSRF). The package executes HTTP requests if the parsed HTML contains external references to resources, such as <iframe src="http://localhost" height="800px" width="800px"></iframe>. This allows attackers to access resources through HTTP that are accessible to the server, including private resources in the hosting environment.
- Record
GHSA-5p98-wpc9-g498- Weakness
- CWE-918
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
html-pdf-chromenpm | before 0.6.1 | 0.6.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-5p98-wpc9-g498 is a vulnerability with no CVSS score yet in html-pdf-chrome, published September 4, 2020. No source lists public exploit code. Fixed in html-pdf-chrome 0.6.1.