GitHub Advisoryadvisory · npm

GHSA-p7c9-jqhq-vr3v Remote Code Execution in markdown-pdf

MEDIUM Published 2018-07-27 Modified 2023-03-01 Official page ↗
Aliases
CVE-2018-3770
Ecosystem
npm
Packages
markdown-pdf
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-22
Reviewed
2020-06-16

Affected packages

• npm markdown-pdf: < 9.0.0 → fixed in 9.0.0

Description

Versions of `markdown-pdf` prior to 9.0.0 are vulnerable to Remote Code Execution. The package fails to sanitize HTML code in markdown files. If markdown files with malicious HTML are converted to PDF, the resulting PDF file will execute any JavaScript code in the original markdown file. This may allow attackers to execute Remote Code. Recommendation Upgrade to version 9.0.0 or later.

Related

Alias · CVE (1)

  • CVE-2018-3770 A path traversal exists in markdown-pdf version <9.0.0 that allows a user to insert a malicious html code that can result in reading the… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References