CVE-2020-14161

Name of the Vulnerable Software and Affected Versions Gotenberg versions through 6.2.1

Description The issue allows for the injection of HTML and/or JavaScript in the HTML to PDF conversion process. This is possible via the "http://localhost:3000/convert/html" endpoint.

Recommendations For versions through 6.2.1, as a temporary workaround, consider restricting access to the /convert/html endpoint until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.