CVE-2023-0835: markdown-pdf vulnerable to local file read via server side cross-site scripting (XSS)

The vulnerability stems from improper input validation when processing user-supplied Markdown. The exploit demonstrates that raw HTML/script tags in Markdown are rendered as executable code during PDF generation. This indicates the Markdown parser (Remarkable) was configured to allow HTML parsing (html: true), enabling XSS. The server-side PhantomJS environment then executes these scripts, allowing local file read. While exact code isn't visible, the advisory and exploit mechanics point directly to the Markdown-to-HTML conversion function with insecure Remarkable configuration as the root cause.