DHTMLX PDF Export Module Remote Code Execution Vulnerability

A remote code execution vulnerability has been identified in the PDF Export Module of DHTMLX's Gantt and Scheduler products, versions 0.3.3 prior to 0.7.6. The vulnerability arises from inadequate sanitization of the 'data' parameter, allowing an unauthenticated attacker to inject malicious JavaScript. This injected code is processed by Node.js and executed, potentially leading to server compromise.

Impact

Exploitation of this vulnerability allows for remote code execution on the server where the affected DHTMLX product is running.

Remediation

Users can upgrade to DHTMLX PDF Export Module version 0.7.6 to address this vulnerability.