This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login.
Read the full analysis โ
Q1What is this vulnerability? (Essence + Consequences)
๐จ **Essence**: A critical **Code Injection** flaw in `md-to-pdf`. ๐ The tool mishandles Markdown front-matter blocks.โฆ
๐ก๏ธ **Root Cause**: **CWE-94** (Code Injection). ๐ The flaw lies in improper handling of **Markdown front-end blocks**. The parser fails to sanitize inputs, allowing arbitrary code injection during the conversion process.
Q3Who is affected? (Versions/Components)
๐ฅ **Affected**: Users of **Simon Haenisch's** `md-to-pdf` tool. ๐ **Version**: All versions **prior to 5.2.5**. ๐ฉ๐ช Developed by a German individual developer. โ ๏ธ If you use this CLI tool, you are at risk.
Q4What can hackers do? (Privileges/Data)
๐ **Attacker Capabilities**: Full **Remote Code Execution**. ๐ **Privileges**: High (CVSS Score indicates Critical impact). ๐ **Impact**: Complete compromise of Confidentiality, Integrity, and Availability.โฆ
๐ **Exploitation Threshold**: **LOW**. ๐ซ **Auth**: None required (PR:N). ๐ **Vector**: Network (AV:N). ๐๏ธ **UI**: None required (UI:N). ๐ฏ **Complexity**: Low (AC:L). This is an easy target for automated attacks.
Q6Is there a public Exp? (PoC/Wild Exploitation)
๐ **Public Exploit**: **No** public PoC or wild exploitation detected yet. ๐ต๏ธโโ๏ธ **Status**: References point to GitHub commits and security advisories (GHSA-547r-qmjm-8hvw).โฆ
๐ **Self-Check**: Check your `md-to-pdf` version. ๐ Run `md-to-pdf --version`. ๐ฉ If version < **5.2.5**, you are vulnerable. ๐งช Scan for CLI tools using this specific package name in your environment.
Q8Is it fixed officially? (Patch/Mitigation)
โ **Official Fix**: **YES**. ๐ฉน **Patch**: Update to version **5.2.5** or later. ๐ **Source**: GitHub Commit `46bdcf2051c8d1758b391c1353185a179a47a4d9`. ๐ Published: Nov 21, 2025.
Q9What if no patch? (Workaround)
๐ง **No Patch Workaround**: If you cannot update immediately, **disable** the tool. ๐ซ Do not process untrusted Markdown files. ๐ Treat any input with front-matter blocks as malicious.โฆ