bentopdf vulnerabilities

2 known vulnerabilities in bentopdf from Alam00000. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.6 High severity

  bentopdf: Server-Side Request Forgery

  CVE-2026-77581Sep 24, 2026Alam00000

  BentoPDF is a client-side PDF toolkit that is self hostable. In 2.8.6 and earlier, the certificate and timestamp CORS proxy in cloudflare/cors-proxy-worker.js uses isPrivateOrReservedHost() to validate a supplied hostname separately from the DNS resolution use

• 7.0 High severity

  bentopdf: Improper Neutralization of Input During Web Page Generation

  CVE-2026-41653May 7, 2026Alam00000

  BentoPDF is a client-side PDF toolkit that is self hostable. Prior to version 2.8.3, a cross-site scripting vulnerability was identified in BentoPD. An attacker may be able to execute arbitrary JavaScript in certain circumstances in Markdown to PDF Tool. This