PT-2021-15541 · Unknown+1 · Gray-Matter+1

Oscar Arnflo · Published 2021-12-10 · Updated 2021-12-16 · CVE-2021-23639

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions md-to-pdf versions prior to 5.0.0

Description The issue allows for Remote Code Execution (RCE) due to the utilization of the gray-matter library to parse front matter content without disabling the JS engine.

Recommendations For versions prior to 5.0.0, update to version 5.0.0 or later to resolve the issue. As a temporary workaround, consider disabling the use of the gray-matter library until a patch is available. Restrict access to the md-to-pdf package to minimize the risk of exploitation.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2021-23639

GHSA-X949-7CM6-FM6P

SNYK-JS-MDTOPDF-1657880

Affected Products

Gray-Matter

Md-To-Pdf

References · 8

• 🔥 https://github.com/simonhaenisch/md-to-pdf/issues/99 · Exploit
• 🔥 https://snyk.io/vuln/SNYK-JS-MDTOPDF-1657880 · Exploit
• https://github.com/simonhaenisch/md-to-pdf/commit/a716259c548c82fa1d3b14a3422e9100619d2d8a · Patch
• https://osv.dev/vulnerability/GHSA-x949-7cm6-fm6p · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-23639 · Security Note
• https://osv.dev/vulnerability/CVE-2021-23639 · Vendor Advisory
• https://github.com/simonhaenisch/md-to-pdf · Note
• https://t.me/cibsecurity/33760 · Telegram Post