BentoPDF’s Markdown to PDF conversion contains a stored cross‑site scripting flaw that allows arbitrary JavaScript to be injected into Markdown documents. When such a document is rendered to PDF and viewed in a browser or PDF viewer that executes embedded scripts, the attacker’s code runs in the context of the viewer, potentially reading browser data, logging activity, or transmitting sensitive information from the victim. The weakness is classified as CWE‑79. No evidence of defacement is provided in the CVE.

All instances of BentoPDF released prior to version 2.8.3 are affected. The vendor product is BentoPDF, a client‑side, self‑hostable PDF toolkit. Versions 2.8.3 and later contain the fix that removes the XSS vector.

The CVSS score of 7 indicates a high‑moderate risk. The EPSS metric is not available, so exploitation probability cannot be quantified. The vulnerability is not listed in CISA’s KEV catalog. Exposing a malicious Markdown file to the editor allows the stored script to persist in the resulting PDF so that it can be executed whenever the PDF is opened in a browser or PDF viewer.