-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper input validation when processing user-supplied Markdown. The exploit demonstrates that raw HTML/script tags in Markdown are rendered as executable code during PDF generation. This indicates the Markdown parser (Remarkable) was configured to allow HTML parsing (html: true), enabling XSS. The server-side PhantomJS environment then executes these scripts, allowing local file read. While exact code isn't visible, the advisory and exploit mechanics point directly to the Markdown-to-HTML conversion function with insecure Remarkable configuration as the root cause.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| markdown-pdf | npm | <= 11.0.0 |
JavaScriptJavaScriptOngoing coverage of React2Shell