Critical Markdown to PDF Flaw (CVE-2025-65108, CVSS 10.0) Allows RCE via JS Injection in Markdown Front-Matter

A critical vulnerability (CVE-2025-65108, CVSS 10.0) in the Markdown to PDF npm package allows remote code execution via JavaScript injection in Markdown front-matter. The flaw arises from how the md-to-pdf tool uses the gray-matter library to parse YAML/JSON front-matter, which can enable the JavaScript evaluation mode when certain delimiters appear.

An attacker could embed malicious JavaScript in a Markdown file’s front matter, turning a simple upload into a full system compromise, with the advisory including a PoC that executes OS commands. All versions below 5.2.5 are vulnerable, and users are urged to update immediately. According to the advisory, the issue stems from the front-matter containing JavaScript that the converter process will run.

The article notes the npm package has more than 47,000 weekly downloads and warns that any server, CI/CD pipeline, or desktop tool processing untrusted Markdown could be exploited simply by opening a malicious file.