The package md-to-pdf before 5.0.0 are vulnerable to Remote Code Execution (RCE) due to utilizing the library gray-matter to parse front matter content, without disabling the JS engine.
Metrics
Affected Vendors & Products
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: snyk
Published: 2021-12-10T20:05:16.643350Z
Updated: 2024-09-17T00:45:43.108Z
Reserved: 2021-01-08T00:00:00
Link: CVE-2021-23639
Vulnrichment
No data.
NVD
Status : Analyzed
Published: 2021-12-10T20:15:08.387
Modified: 2021-12-14T18:48:22.543
Link: CVE-2021-23639
Redhat
No data.