PoC Index85,101 CVEs with PoCs

CVE-2021-23639

Remote Code Execution (RCE)

CRITICAL 9.8EPSS 5.4%

The package md-to-pdf before 5.0.0 are vulnerable to Remote Code Execution (RCE) due to utilizing the library gray-matter to parse front matter content, without disabling the JS engine.

Affected
md-to-pdf
CVSS v3.1 NVD
9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 NVD
7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS
5.41% chance of exploitation in the next 30 days, 93rd percentile
Published
2021-12-10
Updated
2024-09-17

Proof-of-concept exploits (3)

Security advisories

References