CVE-2024-1647
Cross-site Scripting in Pyhtml2pdf
7.5
HIGH
CVSS 3.1
EPSS 0.24%
Description
Pyhtml2pdf version 0.0.6 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate the HTML content entered by the user.
How to fix CVE-2024-1647
No fixed version has been published yet. Mitigate by removing the affected package or applying upstream guidance from the references below.
- PyPI/pyhtml2pdf—no fix listed
- —no fix listed
Is CVE-2024-1647 being exploited?
Low — EPSS is 0.2%, meaning exploitation activity has not been observed at scale.
Affected packages (2)
- from 0, <= 0.0.6
- from 0, <= 0.0.6
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | HIGH7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |