GHSA-x949-7cm6-fm6p

Code Injection in md-to-pdf.

Source: GitHub Advisory Database (reviewed) Critical CVE-2021-23639

Packages

Ecosystem	Package	Affected	Fixed in
npm	md-to-pdf	< 5.0.0	5.0.0

Details

As written in the advisory (Markdown source, shown as plain text).

The package md-to-pdf before 5.0.0 are vulnerable to Remote Code Execution (RCE) due to utilizing the library gray-matter to parse front matter content, without disabling the JS engine.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-23639 advisory
https://github.com/simonhaenisch/md-to-pdf/issues/99 web
https://github.com/simonhaenisch/md-to-pdf/commit/a716259c548c82fa1d3b14a3422e9100619d2d8a web
https://github.com/simonhaenisch/md-to-pdf package
https://snyk.io/vuln/SNYK-JS-MDTOPDF-1657880 web