CVE-2025-65108 json
md-to-pdf is vulnerable to arbitrary JavaScript code execution when parsing front matter
published 2025-11-20 11 mo ago modified 2026-10-18 21 d ago also EUVD-2025-198317 , GHSA-547r-qmjm-8hvw
- cvss
- 10.0
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.0%
- EPSS 1.0% chance of exploitation in 30 days, percentile 61%
- public exploits
- 0
- none known
Summary
md-to-pdf is a CLI tool for converting Markdown files to PDF using Node.js and headless Chrome. Prior to version 5.2.5, a Markdown front-matter block that contains JavaScript delimiter causes the JS engine in gray-matter library to execute arbitrary code in the Markdown to PDF converter process of md-to-pdf library, resulting in remote code execution. This issue has been patched in version 5.2.5.
Patch / fix
- npm md-to-pdf 5.2.5
- markdown_to_pdf_project markdown_to_pdf 5.2.5
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- total
- Assessed
- 11 mo ago
Exploit prediction
0.96% chance of exploitation in the next 30 days, higher than 61% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 10.0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| GitHub | 3.1 | 10.0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | md-to-pdf | <5.2.5 |
5.2.5 |
Affected products
- simonhaenisch md-to-pdf
Classification
- Weakness
-
- CWE-94 Improper Control of Generation of Code
References
Sources
- CVE List CVE-2025-65108
- GitHub Advisory GHSA-547r-qmjm-8hvw
- NVD CVE-2025-65108
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.