Critical severity10.0OSV Advisory· Published Nov 21, 2025· Updated Apr 15, 2026

CVE-2025-65108

Description

md-to-pdf is a CLI tool for converting Markdown files to PDF using Node.js and headless Chrome. Prior to version 5.2.5, a Markdown front-matter block that contains JavaScript delimiter causes the JS engine in gray-matter library to execute arbitrary code in the Markdown to PDF converter process of md-to-pdf library, resulting in remote code execution. This issue has been patched in version 5.2.5.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
md-to-pdfnpm	< 5.2.5	5.2.5

Affected products

Simonhaenisch/Md To PDFOSV
Range: v1.1.0, v1.2.0, v1.2.1, …
ghsa-coords
pkg:npm/md-to-pdf
Range: < 5.2.5

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-547r-qmjm-8hvwghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2025-65108ghsaADVISORY
github.com/simonhaenisch/md-to-pdf/commit/46bdcf2051c8d1758b391c1353185a179a47a4d9nvdWEB
github.com/simonhaenisch/md-to-pdf/security/advisories/GHSA-547r-qmjm-8hvwnvdWEB

News mentions

No linked articles in our index yet.

cvss	0.650
epss	0.001
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000