{"id":"CVE-2025-65108","aliases":["EUVD-2025-198317","GHSA-547r-qmjm-8hvw"],"status":"published","title":"md-to-pdf is vulnerable to arbitrary JavaScript code execution when parsing front matter","description":"md-to-pdf is a CLI tool for converting Markdown files to PDF using Node.js and headless Chrome. Prior to version 5.2.5, a Markdown front-matter block that contains JavaScript delimiter causes the JS engine in gray-matter library to execute arbitrary code in the Markdown to PDF converter process of md-to-pdf library, resulting in remote code execution. This issue has been patched in version 5.2.5.","severity":{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.0096,"percentile":0.61814,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-94"],"published":"2025-11-20T17:48:11Z","modified":"2026-10-28T02:30:28Z","fixes":[{"ecosystem":"npm","package":"md-to-pdf","fixed_in":["5.2.5"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"md-to-pdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.5"}]}]},{"source":"osv","ecosystem":"npm","package":"md-to-pdf","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.2.5"}]}]}],"products":[{"vendor":"simonhaenisch","product":"md-to-pdf"}],"references":[{"url":"https://github.com/simonhaenisch/md-to-pdf/security/advisories/GHSA-547r-qmjm-8hvw","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/simonhaenisch/md-to-pdf/commit/46bdcf2051c8d1758b391c1353185a179a47a4d9","tags":["x_refsource_MISC","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-65108","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-547r-qmjm-8hvw"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/65xxx/CVE-2025-65108.json","tags":["advisory"]},{"url":"https://github.com/simonhaenisch/md-to-pdf","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-65108","title":"md-to-pdf is vulnerable to arbitrary JavaScript code execution when parsing front matter","description":"md-to-pdf is a CLI tool for converting Markdown files to PDF using Node.js and headless Chrome. Prior to version 5.2.5, a Markdown front-matter block that contains JavaScript delimiter causes the JS engine in gray-matter library to execute arbitrary code in the Markdown to PDF converter process of md-to-pdf library, resulting in remote code execution. This issue has been patched in version 5.2.5.","status":"published","published":"2025-11-21T21:52:02.729Z","modified":"2025-11-24T17:17:08.879Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:32:26.64278Z"}],"euvd":[{"id":"EUVD-2025-198317","description":"md-to-pdf is a CLI tool for converting Markdown files to PDF using Node.js and headless Chrome. Prior to version 5.2.5, a Markdown front-matter block that contains JavaScript delimiter causes the JS engine in gray-matter library to execute arbitrary code in the Markdown to PDF converter process of md-to-pdf library, resulting in remote code execution. This issue has been patched in version 5.2.5.","status":"published","published":"2025-11-21T21:52:02Z","modified":"2025-11-24T17:17:08Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T19:49:13.187271Z"}],"ghsa":[{"id":"GHSA-547r-qmjm-8hvw","title":"md-to-pdf vulnerable to arbitrary JavaScript code execution when parsing front matter","description":"### Summary\nA Markdown front-matter block that contains JavaScript delimiter causes the JS engine in gray-matter library to execute arbitrary code in the Markdown to PDF converter process of **md-to-pdf** library, resulting in remote code execution.\n\n### Details\n**md-to-pdf** uses the gray-matter library to parse front-matter. Gray-matter exposes a JavaScript engine that, when enabled or triggered by certain front-matter delimiters (e.g. ---js or ---javascript), will evaluate the front-matter contents as JavaScript. If user-supplied Markdown is fed to md-to-pdf and the front-matter contains malicious JS, the converter process will execute that code.\n\n\n### PoC\n```\nconst { mdToPdf } = require('md-to-pdf');\n\nvar payload = '---javascript\\n((require(\"child_process\")).execSync(\"calc.exe\"))\\n---RCE';\n\n(async () =\u003e {\n\tawait mdToPdf({ content: payload }, { dest: './output.pdf'});\n})();\n```\nRunning the PoC on Windows launches the calculator application, demonstrating arbitrary code execution.\n\n### Impact\n\n- Remote code execution in the process that performs Markdown-\u003ePDF conversion.\n- If the converter is run in a web app or cloud service, an attacker uploading malicious Markdown can execute arbitrary commands on the","status":"published","published":"2025-11-20T17:48:11Z","modified":"2025-11-25T19:48:41Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:39:10.178331Z"}],"nvd":[{"id":"CVE-2025-65108","description":"md-to-pdf is a CLI tool for converting Markdown files to PDF using Node.js and headless Chrome. Prior to version 5.2.5, a Markdown front-matter block that contains JavaScript delimiter causes the JS engine in gray-matter library to execute arbitrary code in the Markdown to PDF converter process of md-to-pdf library, resulting in remote code execution. This issue has been patched in version 5.2.5.","status":"published","published":"2025-11-21T22:16:33.317Z","modified":"2026-10-18T20:10:00.11Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:11:46.009629Z"}],"osv":[{"id":"CVE-2025-65108","title":"md-to-pdf is vulnerable to arbitrary JavaScript code execution when parsing front matter","description":"md-to-pdf is a CLI tool for converting Markdown files to PDF using Node.js and headless Chrome. Prior to version 5.2.5, a Markdown front-matter block that contains JavaScript delimiter causes the JS engine in gray-matter library to execute arbitrary code in the Markdown to PDF converter process of md-to-pdf library, resulting in remote code execution. This issue has been patched in version 5.2.5.","status":"published","published":"2025-11-21T21:52:02.729Z","modified":"2026-10-28T02:30:28.773847132Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:44:52.202386Z"},{"id":"GHSA-547r-qmjm-8hvw","title":"md-to-pdf vulnerable to arbitrary JavaScript code execution when parsing front matter","description":"### Summary\nA Markdown front-matter block that contains JavaScript delimiter causes the JS engine in gray-matter library to execute arbitrary code in the Markdown to PDF converter process of **md-to-pdf** library, resulting in remote code execution.\n\n### Details\n**md-to-pdf** uses the gray-matter library to parse front-matter. Gray-matter exposes a JavaScript engine that, when enabled or triggered by certain front-matter delimiters (e.g. ---js or ---javascript), will evaluate the front-matter contents as JavaScript. If user-supplied Markdown is fed to md-to-pdf and the front-matter contains malicious JS, the converter process will execute that code.\n\n\n### PoC\n```\nconst { mdToPdf } = require('md-to-pdf');\n\nvar payload = '---javascript\\n((require(\"child_process\")).execSync(\"calc.exe\"))\\n---RCE';\n\n(async () =\u003e {\n\tawait mdToPdf({ content: payload }, { dest: './output.pdf'});\n})();\n```\nRunning the PoC on Windows launches the calculator application, demonstrating arbitrary code execution.\n\n### Impact\n\n- Remote code execution in the process that performs Markdown-\u003ePDF conversion.\n- If the converter is run in a web app or cloud service, an attacker uploading malicious Markdown can execute arbitrary commands on the","status":"published","published":"2025-11-20T17:48:11Z","modified":"2025-11-25T19:48:40Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:46:37.864461Z"}]}}