CVE-2025-65108 Security Alert: CRITICAL Vulnerability

Urgent: CVE-2025-65108 requires immediate attention.

· 3 min read

```html

Executive Summary

A critical vulnerability, CVE-2025-65108, has been discovered in the md-to-pdf library, which can lead to remote code execution (RCE) due to improper handling of JavaScript in Markdown front-matter. This vulnerability is rated with a CVSS score of 10, making it essential for all developers using this library to take immediate action to secure their applications.

Immediate Action

  • Immediately review your project dependencies for md-to-pdf.
  • Upgrade to the latest patched version of md-to-pdf as soon as it is available.
  • If you cannot upgrade immediately, consider isolating the service that uses md-to-pdf to mitigate risk.
  • Audit your Markdown input sources to ensure they cannot contain malicious content.
  • Monitor for any unusual activity or unauthorized command execution in your applications.
  • Stay tuned for vendor advisories for further updates (link to vendor advisories).

Affected Versions

  • md-to-pdf@<=current_version vulnerable; upgrade to md-to-pdf@latest+
  • Check the specific version you are using to confirm vulnerability.

Resolution Guide

To mitigate this vulnerability, follow these steps:

npm i md-to-pdf@latest

If you are using a specific version, replace latest with the version number once it is patched.

For configuration hardening, ensure you do not allow untrusted Markdown inputs. Here’s an example of a minimal patch snippet:

const { mdToPdf } = require('md-to-pdf');

// Ensure content is sanitized
const sanitizedContent = sanitizeMarkdown(userInput);
await mdToPdf({ content: sanitizedContent }, { dest: './output.pdf' });

Detection & Verification

To check if your application is vulnerable, verify the version of md-to-pdf:

npm list md-to-pdf

To verify the fix after upgrading, run the version check again. Ensure it reflects the updated version:

npm list md-to-pdf

Risk and Impact

Exploiting CVE-2025-65108 allows attackers to execute arbitrary commands on the server running the Markdown to PDF conversion process, potentially leading to complete system compromise. The blast radius includes any application that utilizes the md-to-pdf library, making it critical for developers to act swiftly to protect their systems.

```

Keep reading