CVE-2025-65108: Simonhaenisch Md-To-PDF

Critical severity, CVSS 10.0. EPSS: 0.9% chance of exploitation in the next 30 days.

md-to-pdf is a CLI tool for converting Markdown files to PDF using Node.js and headless Chrome. Prior to version 5.2.5, a Markdown front-matter block that contains JavaScript delimiter causes the JS engine in gray-matter library to execute arbitrary code in the Markdown to PDF converter process of md-to-pdf library, resulting in remote code execution. This issue has been patched in version 5.2.5.

Affected products

• Simonhaenisch Md-To-PDF: before 5.2.5 (fixed in 5.2.5)

Published 2025-11-21. Last modified 2026-06-17.