CVE-2021-23639

2021-12-1020:15:08

Google

osv.dev

7.4 High

AI Score

Confidence

High

0.019 Low

EPSS

Percentile

88.6%

JSON

The package md-to-pdf before 5.0.0 are vulnerable to Remote Code Execution (RCE) due to utilizing the library gray-matter to parse front matter content, without disabling the JS engine.

CPENameOperatorVersion
md-to-pdfeq2.4.0
md-to-pdfeq3.1.1
md-to-pdfeq3.0.0-pre.1
md-to-pdfeq2.8.2
md-to-pdfeq2.1.4
md-to-pdfeq2.7.1
md-to-pdfeq2.6.4
md-to-pdfeq4.0.0
md-to-pdfeq2.0.0
md-to-pdfeq2.7.0

Name	Operator	Version
md-to-pdf	eq	2.4.0
md-to-pdf	eq	3.1.1
md-to-pdf	eq	3.0.0-pre.1
md-to-pdf	eq	2.8.2
md-to-pdf	eq	2.1.4
md-to-pdf	eq	2.7.1
md-to-pdf	eq	2.6.4
md-to-pdf	eq	4.0.0
md-to-pdf	eq	2.0.0
md-to-pdf	eq	2.7.0