A team building a financial reporting system chose Haukcode.DinkToPdf for its simplicity and zero licensing cost. Six months into production, a security audit flags CVE-2022-35583—a critical SSRF vulnerability in wkhtmltopdf with CVSS score 9.8. The vendor confirms the risk: malicious HTML can force the server to access internal network resources or local files. The wkhtmltopdf project archived in January 2023, so no patch exists. The team now faces a choice: accept the security risk, rebuild the entire reporting system with a different library, or implement extensive input sanitization that may still miss edge cases.

This scenario plays out repeatedly: teams adopt DinkToPdf/Haukcode.DinkToPdf for its straightforward API and free licensing, then discover the underlying wkhtmltopdf binary carries an unfixable critical vulnerability.…