CVE-2021-45394: HTML2PDF Project HTML2PDF

High severity, CVSS 8.8. EPSS: 1.6% chance of exploitation in the next 30 days.

An issue was discovered in Spipu HTML2PDF before 5.2.4. Attackers can trigger deserialization of arbitrary data via the injection of a malicious <link> tag in the converted HTML document.

Affected products

• HTML2PDF Project HTML2PDF: before 5.2.4 (fixed in 5.2.4)

Published 2022-01-18. Last modified 2026-06-17.