CVE-2024-1648: 
JavaScript vulnerability analysis and mitigation

CVE-2024-1648 affects electron-pdf version 20.0.0, discovered and disclosed on February 19, 2024. This vulnerability allows an external attacker to remotely obtain arbitrary local files due to insufficient validation of HTML content entered by users (Fluid Attacks).

The vulnerability stems from the application's failure to validate HTML content for malicious input. It has been assigned a CVSS v3.1 base score of 7.5 HIGH with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, indicating network accessibility, low attack complexity, and no required privileges or user interaction (NVD).

When successfully exploited, this vulnerability allows attackers to read arbitrary local files from the system where electron-pdf is running. This poses a significant security risk as it could lead to unauthorized access to sensitive information (Fluid Attacks).

The vulnerability is easily exploitable by sending malicious HTML content to electron-pdf. An example exploit involves using XMLHttpRequest to read local system files like '/etc/passwd'. The exploit has been confirmed to work and is publicly available (Fluid Attacks).

At the time of disclosure, there was no official patch available for this vulnerability. Users should consider upgrading to a newer version or implementing additional input validation controls (Fluid Attacks).