Executive brief
The mcp-markdownify-server is a file-processing tool used within Model Context Protocol (MCP) servers to convert documents to markdown format. A command injection vulnerability in the pptx-to-markdown tool allows an attacker to inject arbitrary shell commands through unsanitized file paths, resulting in remote code execution under the server's privileges. This can occur through direct tool invocation or indirectly via prompt injection embedded in markdown files.
Technical details
The vulnerability is a shell command injection (CWE-77) caused by the unsafe use of Node.js child_process.exec() with unvalidated user input. The vulnerable code constructs shell commands by directly interpolating file paths and other parameters into command strings without sanitization. An attacker can inject shell metacharacters (|, >, &&, $(), etc.) through the filepath parameter to execute arbitrary commands. The attack can be delivered directly via the pptx-to-markdown tool interface, or indirectly through prompt injection—embedding malicious instructions in markdown file content that an MCP client is tricked into processing. The fix involves replacing child_process.exec() with child_process.execFile(), which accepts arguments as a separate array to prevent shell interpretation. Additionally, tilde-expansion utilities should be used to safely handle relative paths before passing them to execFile().
Affected products
- zcaceres mcp-markdownify-server <=0.0.1
Timeline
- 2025-09-02: disclosed: Advisory published
- 2025-09-02: patched: Fixed in version 0.0.2
- 2025-09-04: advisory: NVD published CVE-2025-58358