CRITICAL 9.8

GHSA-x949-7cm6-fm6p

Code Injection in md-to-pdf.

상세

The package md-to-pdf before 5.0.0 are vulnerable to Remote Code Execution (RCE) due to utilizing the library gray-matter to parse front matter content, without disabling the JS engine.

이 버전이 영향받나요?

사용 중인 패키지 버전을 입력하면 즉시 평가합니다.

영향 패키지

npm / md-to-pdf

최초 영향 버전: 0 수정 버전: 5.0.0

수정 npm install md-to-pdf@5.0.0

참고

https://nvd.nist.gov/vuln/detail/CVE-2021-23639 [ADVISORY]
https://github.com/simonhaenisch/md-to-pdf/issues/99 [WEB]
https://github.com/simonhaenisch/md-to-pdf/commit/a716259c548c82fa1d3b14a3422e9100619d2d8a [WEB]
https://github.com/simonhaenisch/md-to-pdf [PACKAGE]
https://snyk.io/vuln/SNYK-JS-MDTOPDF-1657880 [WEB]