-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| md-to-pdf | npm | < 5.2.5 | 5.2.5 |
Miggo AIRoot Cause AnalysisThe vulnerability exists in the md-to-pdf library because it fails to disable all JavaScript execution engines within its dependency, gray-matter. The library attempts to disable the JavaScript engine for front-matter by providing a custom engine configuration that throws an error. However, it only did so for the js language alias, while gray-matter also supports the javascript alias. An attacker could therefore craft a markdown document with a ---javascript front-matter block containing malicious code. When mdToPdf processes this markdown, gray-matter executes the code, leading to remote code execution on the server running the conversion. The patch corrects this by changing the configuration to disable the javascript engine, thus closing the code execution vector. The primary vulnerable function is mdToPdf as it is the entry point for the vulnerable operation.
mdToPdfsrc/lib/config.ts
Ongoing coverage of React2Shell