CVE-2021-23639

Overview md-to-pdf is a CLI tool for converting Markdown files to PDF. Affected versions of this package are vulnerable to Remote Code Execution RCE due to utilizing the library gray-matter to parse front matter content, without disabling the JS engine. Usage: python3 cve-2021-23639.py targerurl...

CVE-2025-65108 md-to-pdf is vulnerable to arbitrary JavaScript code execution when parsing front matter

md-to-pdf is a CLI tool for converting Markdown files to PDF using Node.js and headless Chrome. Prior to version 5.2.5, a Markdown front-matter block that contains JavaScript delimiter causes the JS engine in gray-matter library to execute arbitrary code in the Markdown to PDF converter process o...

@bitacode/apispecmd-ts (>=0.0.1, <=0.1.2), @bpa-solutions/assistant (>=13.5.0-dev, <=13.5.0) +16 more potentially affected by CVE-2025-65108 via md-to-pdf (>=2.8.2, <=5.2.4)

md-to-pdf NPM version =2.8.2, =0.0.1, =13.5.0-dev, =0.0.0, =0.0.2, =0.0.2, =0.7.2, =1.0.1, =0.2.0, =0.1.0, =1.1.0, =0.2.0, =1.5.0, =1.10.0, =2.0.0 and more Source cves: CVE-2025-65108 Source advisory: MEND:CVE-2025-65108...

CVE-2025-65108 md-to-pdf is vulnerable to arbitrary JavaScript code execution when parsing front matter

md-to-pdf is a CLI tool for converting Markdown files to PDF using Node.js and headless Chrome. Prior to version 5.2.5, a Markdown front-matter block that contains JavaScript delimiter causes the JS engine in gray-matter library to execute arbitrary code in the Markdown to PDF converter process o...

CVE-2025-65108: Improper Control of Generation of Code

md-to-pdf is a CLI tool for converting Markdown files to PDF using Node.js and headless Chrome. Prior to version 5.2.5, a Markdown front-matter block that contains JavaScript delimiter causes the JS engine in gray-matter library to execute arbitrary code in the Markdown to PDF converter process o...

@bpa-solutions/assistant (>=13.5.0-dev, <=13.5.0), @mazaal-dev/piece-markdown-to-pdf (0.0.2) +2 more potentially affected by CVE-2025-65108 via md-to-pdf (>=5.0.1, <=5.2.4)

md-to-pdf NPM version =5.0.1, =13.5.0-dev, =0.11.1, =0.5.52, =0.5.74 Source cves: CVE-2025-65108 Source advisory: GHSA-547R-QMJM-8HVW...

@bpa-solutions/assistant (>=13.5.0-dev, <=13.5.0), @mazaal-dev/piece-markdown-to-pdf (0.0.2) +2 more potentially affected by CVE-2025-65108 via md-to-pdf (>=5.0.1, <=5.2.4)

md-to-pdf NPM version =5.0.1, =13.5.0-dev, =0.11.1, =0.5.52, =0.5.74 Source cves: CVE-2025-65108 Source advisory: OSV:GHSA-547R-QMJM-8HVW...

@bpa-solutions/assistant (>=13.5.0-dev, <=13.5.0), @mazaal-dev/piece-markdown-to-pdf (0.0.2) +2 more potentially affected by CVE-2025-65108 via md-to-pdf (>=5.0.1, <=5.2.4)

md-to-pdf NPM version =5.0.1, =13.5.0-dev, =0.11.1, =0.5.52, =0.5.74 Source cves: CVE-2025-65108 Source advisory: SNYK:JS-MDTOPDF-14089788...

GHSA-547R-QMJM-8HVW md-to-pdf vulnerable to arbitrary JavaScript code execution when parsing front matter

Summary A Markdown front-matter block that contains JavaScript delimiter causes the JS engine in gray-matter library to execute arbitrary code in the Markdown to PDF converter process of md-to-pdf library, resulting in remote code execution. Details md-to-pdf uses the gray-matter library to parse...

md-to-pdf vulnerable to arbitrary JavaScript code execution when parsing front matter

Summary A Markdown front-matter block that contains JavaScript delimiter causes the JS engine in gray-matter library to execute arbitrary code in the Markdown to PDF converter process of md-to-pdf library, resulting in remote code execution. Details md-to-pdf uses the gray-matter library to parse...

Arbitrary Code Injection

Overview md-to-pdf is a CLI tool for converting Markdown files to PDF. Affected versions of this package are vulnerable to Arbitrary Code Injection via the gray-matter library when parsing front matter containing JavaScript delimiters. An attacker can execute arbitrary code in the Markdown-to-PDF...

Exploit for CVE-2021-23639

Overview md-to-pdf is a CLI tool for converting Markdown fil...

Code Injection in md-to-pdf.

The package md-to-pdf before 5.0.0 are vulnerable to Remote Code Execution RCE due to utilizing the library gray-matter to parse front matter content, without disabling the JS engine...

GHSA-X949-7CM6-FM6P Code Injection in md-to-pdf.

The package md-to-pdf before 5.0.0 are vulnerable to Remote Code Execution RCE due to utilizing the library gray-matter to parse front matter content, without disabling the JS engine...

CVE-2021-23639

The package md-to-pdf before 5.0.0 are vulnerable to Remote Code Execution RCE due to utilizing the library gray-matter to parse front matter content, without disabling the JS engine...

CVE-2021-23639

The package md-to-pdf before 5.0.0 are vulnerable to Remote Code Execution RCE due to utilizing the library gray-matter to parse front matter content, without disabling the JS engine...

Remote code execution

The package md-to-pdf before 5.0.0 are vulnerable to Remote Code Execution RCE due to utilizing the library gray-matter to parse front matter content, without disabling the JS engine...

CVE-2021-23639

The package md-to-pdf before 5.0.0 are vulnerable to Remote Code Execution RCE due to utilizing the library gray-matter to parse front matter content, without disabling the JS engine...

@bitacode/apispecmd-ts (>=0.0.1, <=0.1.2), @layer0/node-license-report (>=0.0.0, <=0.0.3) +13 more potentially affected by CVE-2021-23639 via md-to-pdf (>=2.8.2, <=4.1.0)

md-to-pdf NPM version =2.8.2, =0.0.1, =0.0.0, =0.0.2, =0.0.2, =0.7.2, =1.0.1, =0.2.0, =0.1.0, =1.1.0, =0.2.0, =1.5.0, =1.10.0, =1.0.0, =0.0.2, =0.0.10 Source cves: CVE-2021-23639 Source advisory: MEND:CVE-2021-23639...

CVE-2021-23639 Remote Code Execution (RCE)

The package md-to-pdf before 5.0.0 are vulnerable to Remote Code Execution RCE due to utilizing the library gray-matter to parse front matter content, without disabling the JS engine...