Описание
Code Injection in md-to-pdf.
The package md-to-pdf before 5.0.0 are vulnerable to Remote Code Execution (RCE) due to utilizing the library gray-matter to parse front matter content, without disabling the JS engine.
Пакеты
Наименование
md-to-pdf
npm
Затронутые версииВерсия исправления
< 5.0.0
5.0.0
Связанные уязвимости
CVSS3: 9.8
nvd
около 4 лет назад
The package md-to-pdf before 5.0.0 are vulnerable to Remote Code Execution (RCE) due to utilizing the library gray-matter to parse front matter content, without disabling the JS engine.