GHSA-5p98-wpc9-g498: 
JavaScript vulnerability analysis and mitigation

The html-pdf-chrome package was identified with a Server-Side Request Forgery (SSRF) vulnerability, tracked as GHSA-5p98-wpc9-g498. The vulnerability was discovered in versions prior to 0.6.1 and was published to the GitHub Advisory Database on September 4, 2020. The issue affects the npm package html-pdf-chrome, which is used for HTML to PDF conversion (GitHub Advisory).

The vulnerability stems from the package's behavior of executing HTTP requests when the parsed HTML contains external references to resources. This functionality could be exploited through Server-Side Request Forgery (SSRF) attacks, which is classified under CWE-918. The vulnerability was assigned a High severity rating (GitHub Advisory).

When exploited, this vulnerability allows attackers to access resources through HTTP that are accessible to the server, including private resources in the hosting environment. This is particularly concerning when users can input custom HTML for conversion to PDF (GitHub Issue).

The vulnerability is exploitable when users have the ability to input custom HTML content that is then processed by the html-pdf-chrome package for PDF conversion. The issue was initially reported on November 20, 2019 (GitHub Issue).

The vulnerability has been addressed in version 0.6.1 of the package. A Security section has been added since this version to detail proper usage of the library. It's worth noting that npm has subsequently revoked their advisory, as the package is now working as intended (GitHub Advisory).