CVE-2021-23639: Improper Control of Generation of Code ('Code Injection')

December 10, 2021 (updated December 14, 2021)

The package md-to-pdf is vulnerable to Remote Code Execution (RCE) due to utilizing the library gray-matter to parse front matter content, without disabling the JS engine.

References

github.com/simonhaenisch/md-to-pdf/commit/a716259c548c82fa1d3b14a3422e9100619d2d8a
github.com/simonhaenisch/md-to-pdf/issues/99
nvd.nist.gov/vuln/detail/CVE-2021-23639
snyk.io/vuln/SNYK-JS-MDTOPDF-1657880

Code Behaviors & Features

Detect and mitigate CVE-2021-23639 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →