md-to-pdf is vulnerable to arbitrary JavaScript code execution when parsing front matter

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2025-65108 · Microsoft / collected KEV context

EUVD-2025-198317

GHSA-547r-qmjm-8hvw

cve-program · CVE-2025-65108

• https://github.com/simonhaenisch/md-to-pdf/security/advisories/GHSA-547r-qmjm-8hvw
• https://github.com/simonhaenisch/md-to-pdf/commit/46bdcf2051c8d1758b391c1353185a179a47a4d9

euvd · EUVD-2025-198317

• https://github.com/simonhaenisch/md-to-pdf/security/advisories/GHSA-547r-qmjm-8hvw
• https://github.com/simonhaenisch/md-to-pdf/commit/46bdcf2051c8d1758b391c1353185a179a47a4d9

nvd · CVE-2025-65108

• https://github.com/simonhaenisch/md-to-pdf/commit/46bdcf2051c8d1758b391c1353185a179a47a4d9
• https://github.com/simonhaenisch/md-to-pdf/security/advisories/GHSA-547r-qmjm-8hvw

osv · GHSA-547r-qmjm-8hvw

• https://github.com/simonhaenisch/md-to-pdf/security/advisories/GHSA-547r-qmjm-8hvw
• https://nvd.nist.gov/vuln/detail/CVE-2025-65108
• https://github.com/simonhaenisch/md-to-pdf/commit/46bdcf2051c8d1758b391c1353185a179a47a4d9
• https://github.com/simonhaenisch/md-to-pdf

No related operational record is retained in the current change model.