CVE-2022-41957: 
JavaScript vulnerability analysis and mitigation

Muhammara is a node module with c/cpp bindings to modify PDF with JavaScript for node or electron. The vulnerability (CVE-2022-41957) affects versions before 2.6.2 and from 3.0.0 to before 3.3.0, as well as all versions of muhammara's predecessor package hummus. The issue was discovered in November 2022 (GitHub Advisory).

The vulnerability stems from unchecked return values leading to NULL pointer dereferences when parsing maliciously crafted PDF files. The issue has a CVSS v3.1 base score of 7.5 (High severity) with attack vector being Network, attack complexity Low, requiring no privileges or user interaction (GitHub Advisory).

When exploited, this vulnerability can lead to Denial of Service (DoS) when the application attempts to parse a maliciously crafted PDF file (MITRE CVE, GitHub Advisory).

The vulnerability can be triggered by supplying a maliciously crafted PDF file to be parsed. The attack vector is network-based and requires no special privileges or user interaction (GitHub Advisory).

The issue has been patched in muhammara version 3.4.0 and backported to version 2.6.2. For the hummus package, no patch is available. As a workaround, users are advised not to process files from untrusted sources and to replace hummus with muhammara (GitHub Advisory).