critical9.8
CVE-2021-23639
Code Injection in md-to-pdf.
Impact
The package md-to-pdf before 5.0.0 are vulnerable to Remote Code Execution (RCE) due to utilizing the library gray-matter to parse front matter content, without disabling the JS engine.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | md-to-pdf | < 5.0.0 | 5.0.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Markdown To Pdf Project | Markdown To Pdf | before 5.0.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/simonhaenisch/md-to-pdf/commit/a716259c548c82fa1d3b14a3422e9100619d2d8a
- https://github.com/simonhaenisch/md-to-pdf/issues/99
- https://snyk.io/vuln/SNYK-JS-MDTOPDF-1657880
- https://github.com/advisories/GHSA-x949-7cm6-fm6p
- https://nvd.nist.gov/vuln/detail/CVE-2021-23639