CVE-2020-7763: 
JavaScript vulnerability analysis and mitigation

The vulnerability CVE-2020-7763 affects the phantom-html-to-pdf package and involves a path traversal issue that could allow unauthorized access to local files. The vulnerability was discovered and disclosed in 2020, impacting applications that use this HTML-to-PDF conversion library (GitHub Commit).

The vulnerability stems from insufficient validation of file access requests in the phantom-html-to-pdf library. The issue specifically occurs in the resource request handling where the code failed to properly restrict access to local files. The original implementation only checked for 'file:///' protocol, which could be bypassed (GitHub Commit).

This vulnerability could allow attackers to access local files on the system where the application is running, potentially leading to unauthorized access to sensitive information or system files (GitHub Commit).

The vulnerability can be exploited by crafting specific HTML input that includes references to local files. The exploitation is possible when the allowLocalFilesAccess option is not explicitly set to false (GitHub Commit).

The vulnerability has been fixed by implementing stricter protocol validation. The fix ensures that only 'http://' and 'https://' protocols are allowed by default, unless explicitly configured otherwise through the allowLocalFilesAccess option (GitHub Commit).