CVE-2024-1648 HIGH

CVE-2024-1648: electron-pdf 20.0.0 - Local File Read via Server Side XSS

Vendor Electron-Pdf

Product electron-pdf

Weakness CWE-79 · XSS

Published February 20, 2024

Last update December 3, 2025

View on NVD All CVEs

CVSS base score

7.5/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality High

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

electron-pdf version 20.0.0 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate the HTML content entered by the user.

Key dates

02Disclosure timeline

February 20, 2024 CVE published

December 3, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-1648 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html

Related vulnerabilities

04Related CVE

CVE-2021-24214 OpenID Connect Generic Client 3.8.0-3.8.1 - Reflected Cross Site Scripting (XSS) via Login Error CVE-2024-2144 Ultimate Addons for Beaver Builder – Lite <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Separator Widget CVE-2024-6058 LabVantage LIMS cross site scripting CVE-2025-31025 WordPress Image Hover Effects Block plugin <= 1.4.5 - Cross Site Scripting (XSS) Vulnerability CVE-2025-41085 Stored Cross-Site Scripting (XSS) in Apidog web platform