pdfmake Remote Code Execution Vulnerability

A remote code execution vulnerability has been identified in pdfmake versions through 0.2.5. The issue arises from an unsafe evaluation of user-controlled input, allowing arbitrary code execution in the context of the process running pdfmake. This vulnerability is present in the 'dev-playground' feature, specifically within the '/pdf' endpoint of the server.js file.

Impact

Exploitation of this vulnerability allows for remote code execution on the server where pdfmake is running.

Reproduction

To reproduce this vulnerability, send a POST request to the '/pdf' endpoint with a payload that includes JavaScript code. The server will execute the code using 'eval()' without any sanitization or sandboxing. For example, a payload could be crafted to execute a command that reads sensitive files, such as '/etc/passwd', and returns the contents in the generated PDF.