Code Injection in md-to-pdf.

CRITICO 9.8CVE-2021-23639 · GHSA-x949-7cm6-fm6p · SNYK-JS-MDTOPDF-1657880 · Published 10/12/2021 · updated 17/06/2026

In breve

CVE-2021-23639 è una vulnerabilità CRITICO (CVSS 9.8) che riguarda markdown to pdf (markdown to pdf project), md-to-pdf.
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 5.4%, superiore al 92.7% delle vulnerabilità.
Correzione: aggiornare a 5.0.0 o successiva.

Package	Affected versions	Patched versions
markdown to pdf markdown_to_pdf_project	`< 5.0.0`	`5.0.0`
md-to-pdf npm	`< 5.0.0`	`5.0.0`

Description

The package md-to-pdf before 5.0.0 are vulnerable to Remote Code Execution (RCE) due to utilizing the library gray-matter to parse front matter content, without disabling the JS engine.

NVD description

The package md-to-pdf before 5.0.0 are vulnerable to Remote Code Execution (RCE) due to utilizing the library gray-matter to parse front matter content, without disabling the JS engine.

References

nvd.nist.gov/vuln/detail/CVE-2021-23639 · ADVISORY
simonhaenisch/md-to-pdf · WEB
simonhaenisch/md-to-pdf commit a716259 · WEB
simonhaenisch/md-to-pdf · PACKAGE
snyk.io/vuln/SNYK-JS-MDTOPDF-1657880 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free