{"id":"EUVD-2025-198317","enisaUuid":"ea0d970c-1287-36d5-8d2b-39064bdca9da","description":"md-to-pdf is a CLI tool for converting Markdown files to PDF using Node.js and headless Chrome. Prior to version 5.2.5, a Markdown front-matter block that contains JavaScript delimiter causes the JS engine in gray-matter library to execute arbitrary code in the Markdown to PDF converter process of md-to-pdf library, resulting in remote code execution. This issue has been patched in version 5.2.5.","datePublished":"Nov 21, 2025, 9:52:02 PM","dateUpdated":"Nov 24, 2025, 5:17:08 PM","baseScore":10.0,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","references":"https://github.com/simonhaenisch/md-to-pdf/security/advisories/GHSA-547r-qmjm-8hvw\nhttps://github.com/simonhaenisch/md-to-pdf/commit/46bdcf2051c8d1758b391c1353185a179a47a4d9\n","aliases":"CVE-2025-65108\nGHSA-547r-qmjm-8hvw\n","assigner":"GitHub_M","epss":0.96,"enisaIdProduct":[{"id":"54d9bdab-d997-37b2-ab52-7e75e66c7b26","product":{"name":"md-to-pdf","vendor":{"name":"simonhaenisch"}},"product_version":"\u003c 5.2.5"}],"enisaIdVendor":[{"id":"b6e0d37e-c02e-3fcd-b902-a1e1bcbe10f4","vendor":{"name":"simonhaenisch"}}],"enisaIdVulnerability":[{"id":"5e3bf1fe-0794-3cbf-ae69-d0b20e916aee","vulnerability":{"id":"CVE-2025-65108","description":"md-to-pdf is a CLI tool for converting Markdown files to PDF using Node.js and headless Chrome. Prior to version 5.2.5, a Markdown front-matter block that contains JavaScript delimiter causes the JS engine in gray-matter library to execute arbitrary code in the Markdown to PDF converter process of md-to-pdf library, resulting in remote code execution. This issue has been patched in version 5.2.5.","datePublished":"Nov 21, 2025, 9:52:02 PM","dateUpdated":"Nov 24, 2025, 5:17:08 PM","status":"PUBLISHED","baseScore":10.0,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","references":"https://github.com/simonhaenisch/md-to-pdf/security/advisories/GHSA-547r-qmjm-8hvw\nhttps://github.com/simonhaenisch/md-to-pdf/commit/46bdcf2051c8d1758b391c1353185a179a47a4d9\n","enisa_id":"EUVD-2025-198317\n","assigner":"GitHub_M","epss":0.96,"dataProcessed":"Nov 6, 2026, 7:21:05 AM","vulnerabilityProduct":[{"id":"17f9fbc3-a015-3bce-b751-400a9a359346","product":{"name":"md-to-pdf","vendor":{"name":"simonhaenisch"}},"product_version":"\u003c 5.2.5"}],"vulnerabilityVendor":[{"id":"8f942cb9-60b2-30dd-b7e8-c4b8f9833527","vendor":{"name":"simonhaenisch"}}]}},{"id":"7f4898cc-3afe-36ed-8fe3-6fc50a61e332","vulnerability":{"id":"GHSA-547r-qmjm-8hvw","description":"md-to-pdf vulnerable to arbitrary JavaScript code execution when parsing front matter","datePublished":"Nov 20, 2025, 5:48:11 PM","dateUpdated":"Nov 25, 2025, 7:48:40 PM","baseScore":0.0,"references":"https://github.com/simonhaenisch/md-to-pdf/security/advisories/GHSA-547r-qmjm-8hvw\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-65108\nhttps://github.com/simonhaenisch/md-to-pdf/commit/46bdcf2051c8d1758b391c1353185a179a47a4d9\nhttps://github.com/simonhaenisch/md-to-pdf\n","enisa_id":"EUVD-2025-198317\n","aliases":"GHSA-547r-qmjm-8hvw\nCVE-2025-65108\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 1:56:19 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}