CVE-2025-65108 md-to-pdf is vulnerable to arbitrary JavaScript code execution when parsing front matter

md-to-pdf is a CLI tool for converting Markdown files to PDF using Node.js and headless Chrome. Prior to version 5.2.5, a Markdown front-matter block that contains JavaScript delimiter causes the JS engine in gray-matter library to execute arbitrary code in the Markdown to PDF converter process o...

CVE-2025-65108

CVE-2025-65108 affects the md-to-pdf CLI (Markdown to PDF) where parsing front matter with a JavaScript delimiter can trigger the gray-matter JS engine to execute arbitrary code during the conversion process, enabling remote code execution. This vulnerability exists in versions prior to 5.2.5 and...

@bpa-solutions/assistant (>=13.5.0-dev, <=13.5.0), @mazaal-dev/piece-markdown-to-pdf (0.0.2) +2 more potentially affected by CVE-2025-65108 via md-to-pdf (>=5.0.1, <=5.2.4)

md-to-pdf NPM version =5.0.1, =13.5.0-dev, =0.11.1, =0.5.52, =0.5.65 Source cves: CVE-2025-65108 Source advisory: SNYK:JS-MDTOPDF-14089788...

@bpa-solutions/assistant (>=13.5.0-dev, <=13.5.0), @mazaal-dev/piece-markdown-to-pdf (0.0.2) +2 more potentially affected by CVE-2025-65108 via md-to-pdf (>=5.0.1, <=5.2.4)

md-to-pdf NPM version =5.0.1, =13.5.0-dev, =0.11.1, =0.5.52, =0.5.65 Source cves: CVE-2025-65108 Source advisory: OSV:GHSA-547R-QMJM-8HVW...