CVE-2026-77581
HighCVSS 8.6Summary
BentoPDF in 2.8.6 and earlier has a vulnerability in the certificate and timestamp CORS proxy in cloudflare/cors-proxy-worker.js that uses isPrivateOrReservedHost() to validate a supplied hostname separately from the DNS resolution used by fetch(targetUrl), allowing an attacker-controlled hostname to resolve to an internal or reserved destination after validation. A certificate-like path can satisfy ALLOWED_PATH_PATTERNS, and direct clients can forge the Origin header. Deployments without PROXY_SECRET skip the optional signature check.
Risk Assessment
The risk includes access to internal or reserved resources, potentially leading to data leakage or unauthorized actions.
Recommendation
Upgrade BentoPDF to version 2.8.7, which fixes this vulnerability, and configure PROXY_SECRET to strengthen security.
Other vulnerabilities in BentoPDF
See all- CVE-2026-63630Low
BentoPDF is a client-side PDF toolkit that is self hostable. In 2.8.6 and earlier, deserializeWorkflow() accepts the Timestamp node's tsaUrl control from imported JSON without schema or destination validation. When a user imports the crafted workflow and runs it against a PDF, timestampPdf() sends an RFC 3161 TimeStampReq containing the PDF's SHA-256 MessageImprint to the attacker-selected endpoint. The default self-hosted configuration does not set VITE_CORS_PROXY_URL, so the request bypasses the proxy's ALLOWED_TSA_HOSTS checks and is sent directly. The disclosed digest can confirm that a document matches a known file and can correlate the same document across users without revealing its contents. This vulnerability is fixed in 2.8.7.
- CVE-2026-41653High
In BentoPDF, prior to version 2.8.3, a cross-site scripting (XSS) vulnerability was identified. An attacker could execute arbitrary JavaScript under certain circumstances in the Markdown to PDF Tool.
Original NVD description (English source)
BentoPDF is a client-side PDF toolkit that is self hostable. In 2.8.6 and earlier, the certificate and timestamp CORS proxy in cloudflare/cors-proxy-worker.js uses isPrivateOrReservedHost() to validate a supplied hostname separately from the DNS resolution used by fetch(targetUrl), allowing an attacker-controlled hostname to resolve to an internal or reserved destination after validation. A certificate-like path can satisfy ALLOWED_PATH_PATTERNS, and direct clients can forge the browser-oriented Origin header. Deployments without PROXY_SECRET skip the optional signature check, while the signature is an anti-abuse measure rather than a destination-security boundary. The proxy has a 10 MB response limit and can relay response bodies from reachable destinations. The advisory identifies both the official Worker deployment and self-hosted instances as impacted where the Worker execution environment can reach internal or reserved destinations. This vulnerability is fixed in 2.8.7.