GHSA-547R-QMJM-8HVW

Vulnerability from github – Published: 2025-11-20 17:48 – Updated: 2025-11-25 19:48
VLAI
Summary
md-to-pdf vulnerable to arbitrary JavaScript code execution when parsing front matter
Details

Summary

A Markdown front-matter block that contains JavaScript delimiter causes the JS engine in gray-matter library to execute arbitrary code in the Markdown to PDF converter process of md-to-pdf library, resulting in remote code execution.

Details

md-to-pdf uses the gray-matter library to parse front-matter. Gray-matter exposes a JavaScript engine that, when enabled or triggered by certain front-matter delimiters (e.g. ---js or ---javascript), will evaluate the front-matter contents as JavaScript. If user-supplied Markdown is fed to md-to-pdf and the front-matter contains malicious JS, the converter process will execute that code.

PoC

const { mdToPdf } = require('md-to-pdf');

var payload = '---javascript\n((require("child_process")).execSync("calc.exe"))\n---RCE';

(async () => {
    await mdToPdf({ content: payload }, { dest: './output.pdf'});
})();

Running the PoC on Windows launches the calculator application, demonstrating arbitrary code execution.

Impact

  • Remote code execution in the process that performs Markdown->PDF conversion.
  • If the converter is run in a web app or cloud service, an attacker uploading malicious Markdown can execute arbitrary commands on the
Severity
10.0 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "md-to-pdf"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.2.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-65108"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-11-20T17:48:11Z",
    "nvd_published_at": "2025-11-21T22:16:33Z",
    "severity": "CRITICAL"
  },
  "details": "### Summary\nA Markdown front-matter block that contains JavaScript delimiter causes the JS engine in gray-matter library to execute arbitrary code in the Markdown to PDF converter process of **md-to-pdf** library, resulting in remote code execution.\n\n### Details\n**md-to-pdf** uses the gray-matter library to parse front-matter. Gray-matter exposes a JavaScript engine that, when enabled or triggered by certain front-matter delimiters (e.g. ---js or ---javascript), will evaluate the front-matter contents as JavaScript. If user-supplied Markdown is fed to md-to-pdf and the front-matter contains malicious JS, the converter process will execute that code.\n\n\n### PoC\n```\nconst { mdToPdf } = require(\u0027md-to-pdf\u0027);\n\nvar payload = \u0027---javascript\\n((require(\"child_process\")).execSync(\"calc.exe\"))\\n---RCE\u0027;\n\n(async () =\u003e {\n\tawait mdToPdf({ content: payload }, { dest: \u0027./output.pdf\u0027});\n})();\n```\nRunning the PoC on Windows launches the calculator application, demonstrating arbitrary code execution.\n\n### Impact\n\n- Remote code execution in the process that performs Markdown-\u003ePDF conversion.\n- If the converter is run in a web app or cloud service, an attacker uploading malicious Markdown can execute arbitrary commands on the",
  "id": "GHSA-547r-qmjm-8hvw",
  "modified": "2025-11-25T19:48:40Z",
  "published": "2025-11-20T17:48:11Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/simonhaenisch/md-to-pdf/security/advisories/GHSA-547r-qmjm-8hvw"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-65108"
    },
    {
      "type": "WEB",
      "url": "https://github.com/simonhaenisch/md-to-pdf/commit/46bdcf2051c8d1758b391c1353185a179a47a4d9"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/simonhaenisch/md-to-pdf"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "md-to-pdf vulnerable to arbitrary JavaScript code execution when parsing front matter"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.