Loading story…
A critical vulnerability (CVE-2025-65108, CVSS 10.0) has been identified in the md-to-pdf tool, which is used to convert Markdown files to PDF using Node.js and headless Chrome. The flaw allows attackers to achieve remote code execution by injecting malicious JavaScript into the front-matter section of Markdown files, exploiting the way the gray-matter library parses these blocks. This vulnerability is remotely exploitable and poses a significant risk to any system processing untrusted Markdown files with affected versions of md-to-pdf.
The issue has been addressed in version 5.2.5 of the md-to-pdf library, and users are strongly advised to update to this version to mitigate the risk. No specific affected product versions are listed, but the vulnerability impacts all prior versions that use the vulnerable parsing mechanism. Security advisories have been published to highlight the severity and exploitation potential of this flaw, emphasizing the need for immediate remediation in environments where Markdown-to-PDF conversion is automated or exposed to user-supplied content.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
A subsequent public report described CVE-2025-65108 as a CVSS 10.0 issue that can lead to remote code execution through JavaScript injection in Markdown front matter. The available reporting did not include vendor remediation or exploitation details.
A critical vulnerability, CVE-2025-65108, was published affecting md-to-pdf. The flaw allows arbitrary JavaScript code execution when parsing Markdown front matter.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical vulnerability, tracked as CVE-2025-68428, was discovered in the *jsPDF* library, which is widely used for generating PDFs in JavaScript applications. The flaw allows attackers to exploit local file inclusion and path traversal in the Node.js build of jsPDF by passing unsanitized paths to the `loadFile` method, potentially enabling unauthorized access to arbitrary files on the server. Other affected methods include `addImage`, `html`, and `addFont`, with the vulnerability present in the `dist/jspdf.node.js` and `dist/jspdf.node.min.js` files. The issue has been addressed in jsPDF version 4.0.0, which restricts file system access by default. The vulnerability is remotely exploitable and poses a significant risk to applications that allow user-controlled input to these methods. jsPDF recommends updating to version 4.0.0 or later and, for older Node.js versions, sanitizing user-provided paths before use. Additionally, Node.js environments should leverage the `--permission` flag to further restrict file system access. Organizations using jsPDF in server-side environments are urged to review their implementations and apply the necessary updates or mitigations to prevent potential data breaches or unauthorized file access.
Jun 29, 2026
A high-severity vulnerability tracked as **`CVE-2026-53597`** was disclosed in Microsoft’s Prompty project, where the `@prompty/core` TypeScript loader could execute attacker-controlled JavaScript embedded in `.prompty` files. The issue stemmed from use of `gray-matter` without disabling executable `js` and `javascript` frontmatter engines, creating a **CWE-94** arbitrary code execution condition during prompt loading. Affected versions span **`2.0.0-alpha.1`** through versions before **`2.0.0-beta.3`**. Microsoft addressed the flaw by changing the Prompty TypeScript runtime to explicitly reject executable frontmatter instead of parsing it. The fix, committed in `microsoft/prompty@c27402d`, adds a `rejectExecutableFrontmatter` function that throws an error when JavaScript frontmatter is encountered, and includes a test confirming malicious frontmatter cannot execute code or create files. The remediation was released as part of coordinated package updates to **`2.0.0-beta.3`** across `@prompty/core` and related packages including `@prompty/anthropic`, `@prompty/openai`, and `@prompty/foundry`.
Jul 18, 2026
HashiCorp disclosed **HCSEC-2026-01** (tracked as **CVE-2026-0969** / **GHSA-g4xw-jxrg-5f6m**) affecting the *next-mdx-remote* library used by Next.js applications to render MDX content. The flaw can lead to **arbitrary code execution** when applications **server-side render untrusted MDX** due to insufficient sanitization in the `serialize` compilation path, particularly when JavaScript expressions in MDX are permitted; the issue is categorized as **CWE-94 (code injection)** and reported with a **CVSS 3.1 score of 8.8 (High)**. Guidance from the Canadian Centre for Cyber Security and third-party analysis both recommend updating affected deployments. Impacted versions are reported as **4.3.0 through 5.0.0** (Cyber Centre advisory) and **4.3.0 up to but not including 6.0.0** (Socket), with remediation available in **6.0.0**; the 6.0.0 release also changes defaults to reduce exposure by disabling JavaScript expressions by default (`blockJS: true`) and adding additional guardrails when dangerous JS is explicitly enabled (e.g., best-effort blocking of constructs like `eval`, `Function`, `process`, and `require`).
Jun 29, 2026