Remote Code Execution in markdown-pdf
Moderate severity
GitHub Reviewed
Published
Jul 27, 2018
to the GitHub Advisory Database
•
Updated Mar 1, 2023
Description
Published by the National Vulnerability Database
Jul 20, 2018
Published to the GitHub Advisory Database
Jul 27, 2018
Reviewed
Jun 16, 2020
Last updated
Mar 1, 2023
Versions of
markdown-pdfprior to 9.0.0 are vulnerable to Remote Code Execution. The package fails to sanitize HTML code in markdown files. If markdown files with malicious HTML are converted to PDF, the resulting PDF file will execute any JavaScript code in the original markdown file. This may allow attackers to execute Remote Code.Recommendation
Upgrade to version 9.0.0 or later.
References