CVE-2024-9075— Stirling-Tools Stirling-PDF Markdown-to-PDF cross site scripting
Quick assessment
Affected
Stirling-Tools Stirling-PDF
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Stirling-PDF是Stirling Tools开源的一个使用 Docker 的强大、本地托管的基于 Web 的 PDF 操作工具。 Stirling-PDF 0.28.3及之前版本存在跨站脚本漏洞，该漏洞源于Markdown-to-PDF组件中的未知代码，导致跨站脚本攻击。
Possible ATT&CK Techniques 1 AI
T1059 · Command and Scripting Interpreter
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2024-9075
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Stirling-Tools Stirling-PDF Markdown-to-PDF cross site scripting
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability was found in Stirling-Tools Stirling-PDF up to 0.28.3. It has been declared as problematic. This vulnerability affects unknown code of the component Markdown-to-PDF. The manipulation leads to cross site scripting. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 0.29.0 is able to address this issue. It is recommended to upgrade the affected component. The vendor explains that "this functionality was removed in 0.29.0 already" and "we plan to re-add at later date with issue resolved".
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Vulnerability Title
Stirling-PDF 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Stirling-PDF是Stirling Tools开源的一个使用 Docker 的强大、本地托管的基于 Web 的 PDF 操作工具。 Stirling-PDF 0.28.3及之前版本存在跨站脚本漏洞，该漏洞源于Markdown-to-PDF组件中的未知代码，导致跨站脚本攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Stirling-Tools | Stirling-PDF | 0.28.0 | - |
|
II. Public POCs for CVE-2024-9075
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-9075
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same product: Stirling-PDF
-
CVE-2026-85714
Stirling-PDF: Remote Code Execution via H2 -
CVE-2026-57485
Stirling-PDF: Internal Service Account API Key Disclosure vi -
CVE-2026-33437
Stirling PDF: Stored XSS in Info Summary -
CVE-2026-71270
Stirling-PDF Server-Side Request Forgery via /api/v1/convert -
CVE-2026-41580
Stirling-PDF: Reflected XSS through crafted PDF metadata fie
Same vendor: Stirling-Tools
-
CVE-2026-85714
Stirling-PDF: Remote Code Execution via H2 -
CVE-2026-57485
Stirling-PDF: Internal Service Account API Key Disclosure vi -
CVE-2026-33437
Stirling PDF: Stored XSS in Info Summary -
CVE-2026-71270
Stirling-PDF Server-Side Request Forgery via /api/v1/convert -
CVE-2026-41580
Stirling-PDF: Reflected XSS through crafted PDF metadata fie
Same weakness: CWE-79
-
CVE-2026-100186
User Profile Builder <= 4.0.3 - Unauthenticated Stored Cross -
CVE-2026-88963
Tutor LMS <= 4.0.8 - Authenticated (Subscriber+) Reflected D -
CVE-2026-109513
NotificationX <= 3.3.3 - Unauthenticated Stored Cross-Site S -
CVE-2026-111122
SiteOrigin CSS <= 1.6.7 - Unauthenticated Stored DOM-Based C -
CVE-2026-107764
SiteOrigin CSS <= 1.6.7 - Unauthenticated Stored DOM-Based C
V. Comments for CVE-2024-9075
No comments yet