CVE-2020-7740

This affects all versions of package node-pdf-generator. Due to lack of user input validation and sanitization done to the content given to node-pdf-generator, it is possible for an attacker to craft a url that will be passed to an external server allowing an SSRF attack.

• CWE-20
• CWE-918

• https://github.com/darrenhaken/node-pdf-generator/blob/master/index.js%23L29Broken Link, Third Party Advisory
• https://snyk.io/vuln/SNYK-JS-NODEPDFGENERATOR-609636Third Party Advisory
• https://github.com/darrenhaken/node-pdf-generator/blob/master/index.js%23L29Broken Link, Third Party Advisory
• https://snyk.io/vuln/SNYK-JS-NODEPDFGENERATOR-609636Third Party Advisory

Published

Oct 6, 2020

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-7734All versions of package cabot are vulnerable to Cross-site S…8.2
• CVE-2020-7735The package ng-packagr before 10.1.1 are vulnerable to Comma…6.6
• CVE-2020-7736The package bmoor before 0.8.12 are vulnerable to Prototype …9.8
• CVE-2020-7737All versions of package safetydance are vulnerable to Protot…9.8
• CVE-2020-7738All versions of package shiba are vulnerable to Arbitrary Co…8.3
• CVE-2020-7739This affects all versions of package phantomjs-seo. It is po…8.2
• CVE-2020-7741This affects the package hellojs before 1.18.6. The code get…9.9
• CVE-2020-7742This affects the package simpl-schema before 1.10.2.7.5
• CVE-2020-7743The package mathjs before 7.5.1 are vulnerable to Prototype …7.3
• CVE-2020-7744This affects all versions of package com.mintegral.msdk:alph…4.7
• CVE-2020-7745This affects the package MintegralAdSDK before 6.6.0.0. The …7.1
• CVE-2020-7746This affects the package chart.js before 2.9.4. The options …9.8