CVE-2021-23639: Markdown To PDF Project Markdown To PDF

Critical severity, CVSS 9.8. EPSS: 5.4% chance of exploitation in the next 30 days.

The package md-to-pdf before 5.0.0 are vulnerable to Remote Code Execution (RCE) due to utilizing the library gray-matter to parse front matter content, without disabling the JS engine.

Affected products

• Markdown To PDF Project Markdown To PDF: before 5.0.0 (fixed in 5.0.0)

Published 2021-12-10. Last modified 2026-06-17.