Executive brief
markdown-pdf is a widely-used npm package that converts Markdown documents to PDF files. Versions prior to 9.0.0 fail to sanitize HTML embedded in markdown, allowing attackers to inject and execute arbitrary JavaScript code during PDF generation. An attacker who controls the markdown input could achieve remote code execution on the system processing the file.
Technical details
The vulnerability is a code injection flaw (CWE-22) in markdown-pdf's HTML handling. The package does not properly sanitize or escape HTML code present in markdown input before rendering it to PDF. When a markdown file containing malicious HTML or embedded JavaScript is converted to PDF, the JavaScript payload executes within the PDF rendering context, leading to remote code execution. The attack requires that an attacker can supply or control the markdown input being processed; no authentication is required. The fix is available in version 9.0.0 and later, which properly sanitizes HTML input.
Affected products
- npm markdown-pdf before 9.0.0
Timeline
- 2018-07-20: disclosed
- 2018: patched: Version 9.0.0 released