CVE-2021-23639

Katalog CVE

CVSS 9.8 · Critical EPSS 5,4%

Kerentanan pada markdown to pdf project markdown to pdf. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

The package md-to-pdf before 5.0.0 are vulnerable to Remote Code Execution (RCE) due to utilizing the library gray-matter to parse front matter content, without disabling the JS engine.

Rincian

Terbit di NVD

10 Desember 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

EPSS (30 hari)

5,4% peluang dieksploitasi; lebih tinggi dari 92,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/simonhaenisch/md-to-pdf/commit/a716259c548c82fa1d3b14a3422e9100619d2d8a patch · advisory pihak ketiga
• https://github.com/simonhaenisch/md-to-pdf/issues/99 exploit · issue tracking · patch · advisory pihak ketiga
• https://snyk.io/vuln/SNYK-JS-MDTOPDF-1657880 exploit · patch · advisory pihak ketiga