CVEs-PoC/2021/CVE-2021-23639.md

CVE-2021-23639

Description

The package md-to-pdf before 5.0.0 are vulnerable to Remote Code Execution (RCE) due to utilizing the library gray-matter to parse front matter content, without disabling the JS engine.

POC

Reference

• https://github.com/simonhaenisch/md-to-pdf/issues/99
• https://snyk.io/vuln/SNYK-JS-MDTOPDF-1657880

Github

• https://github.com/ARPSyndicate/cvemon
• https://github.com/itsmiki/hackthebox-web-challenge-payloads