CVE-2025-65108: md-to-pdf vulnerable to arbitrary JavaScript code execution when parsing front matter

November 20, 2025 (updated November 25, 2025)

A Markdown front-matter block that contains JavaScript delimiter causes the JS engine in gray-matter library to execute arbitrary code in the Markdown to PDF converter process of md-to-pdf library, resulting in remote code execution.

References

github.com/advisories/GHSA-547r-qmjm-8hvw
github.com/simonhaenisch/md-to-pdf
github.com/simonhaenisch/md-to-pdf/commit/46bdcf2051c8d1758b391c1353185a179a47a4d9
github.com/simonhaenisch/md-to-pdf/security/advisories/GHSA-547r-qmjm-8hvw
nvd.nist.gov/vuln/detail/CVE-2025-65108

Code Behaviors & Features

Detect and mitigate CVE-2025-65108 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →