CVE-2018-3770: Remote Code Execution in markdown-pdf
Summary
CVE-2018-3770: Remote Code Execution in markdown-pdf. Affects markdown-pdf versions < 9.0.0. Fixed in 9.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
markdown-pdf is an npm package that converts markdown files to PDF. It is commonly used for generating PDF documents from markdown content. However, versions prior to 9.0.0 are vulnerable to Remote Code Execution. The package fails to properly sanitize HTML code in markdown files, allowing attackers to inject malicious JavaScript code. When these markdown files are converted to PDF, the resulting PDF file will execute the injected JavaScript code. This vulnerability poses a risk of remote code execution.
Vulnerability Detail
The vulnerability in markdown-pdf arises from its failure to sanitize HTML code in markdown files. This allows an attacker to inject malicious JavaScript code into the markdown file. When the file is converted to PDF using markdown-pdf, the resulting PDF file will execute the injected JavaScript code. This can lead to remote code execution, enabling an attacker to execute arbitrary code on the victim's system. The impact of this vulnerability can be severe, as it allows an attacker to gain unauthorized access and potentially compromise the entire system.
How To Fix
Minimum fixed version
9.0.0
This is the first release that contains the fix.
npm install markdown-pdf@9.0.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of markdown-pdf to mitigate the risk of remote code execution.
Conclusion
The vulnerability in markdown-pdf allows for remote code execution due to the lack of HTML code sanitization. Upgrading to version 9.0.0 or later is crucial to mitigate this risk. It is recommended to promptly update the package to ensure the security of the system. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for markdown-pdf →
FAQ
markdown-pdf is an npm package used for converting markdown files to PDF.
The vulnerability allows an attacker to execute arbitrary code on the victim's system, potentially leading to unauthorized access and compromise of the entire system.
To fix this vulnerability, you need to upgrade to version 9.0.0 or later of markdown-pdf.
No, there is no known workaround. Upgrading to the fixed version is the recommended solution.
You can find more information about this vulnerability in the GitHub Advisory Database.
Related vulnerabilities
Recent vulnerabilities recorded for markdown-pdf.
