CVE-2021-23639: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

December 16, 2021

The package md-to-pdf are vulnerable to Remote Code Execution (RCE) due to utilizing the library gray-matter to parse front matter content, without disabling the JS engine.

References

github.com/advisories/GHSA-x949-7cm6-fm6p
github.com/simonhaenisch/md-to-pdf/commit/a716259c548c82fa1d3b14a3422e9100619d2d8a
github.com/simonhaenisch/md-to-pdf/issues/99
nvd.nist.gov/vuln/detail/CVE-2021-23639
snyk.io/vuln/SNYK-JS-MDTOPDF-1657880

Code Behaviors & Features

Detect and mitigate CVE-2021-23639 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →