p PatchFirst

CVE-2025-65108

CVE-2025-65108 · md-to-pdf is vulnerable to arbitrary JavaScript code execution when parsing front matter

This page contains facts from public vulnerability sources. Check the original advisory before updating.

md-to-pdf is a CLI tool for converting Markdown files to PDF using Node.js and headless Chrome. Prior to version 5.2.5, a Markdown front-matter block that contains JavaScript delimiter causes the JS engine in gray-matter library to execute arbitrary code in the Markdown to PDF converter process of md-to-pdf library, resulting in remote code execution. This issue has been patched in version 5.2.5.

CVSS 10.0 · Critical · EPSS 1.0% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • md-to-pdf

    Versions
    • < 5.2.5: Affected

    No fix published

  • md-to-pdf npm

    Affected ranges
    • SEMVER: < 5.2.5

    Update to 5.2.5

Original sources

Check your server →