# A Single Line of Markdown Can Wreck the Server: What Is the CVE-2025-65108 Vulnerability Hiding?

## **Description of CVE-2025-65108**

For those who don't know, **Markdown** is a simple **markup language** used to format text with easy-to-remember and easy-to-type characters. It is designed to be:

* **Easy to read** in plain text.
    
* **Easy to write.**
    
* **Easy to convert** to HTML, PDF, and other formats.
    

To understand better, I'll show you some special characters that are easy to use in Markdown, such as:

| You type | Markdown will display as |
| --- | --- |
| `# Title` | Large Title |
| `**bold**` | **bold** |
| `*italic*` | *italic* |
| `- list` | list |
| `code` | `code` |

Because of its convenience, Markdown is widely used by developers, document writers, and bloggers, which also makes it a potential target for vulnerabilities that attackers want to exploit. In November 2025, cybersecurity experts identified a new vulnerability labeled **CVE-2025-65108**, rated **CVSS 10.0 – absolute danger level**, revealing that *just a piece of front-matter in Markdown can open the door to Remote Code Execution*.

![md-to-pdf RCE, Markdown Command Injection](https://securityonline.info/wp-content/uploads/2025/11/markdown-to-pdf-scaled.png align="center")

This vulnerability is not just a software bug; it highlights the thin line between "text formatting" and "malicious code execution." If you are using tools to convert Markdown to PDF in your system, this could be a ticking time bomb silently counting down...

## **Scope of Impact**

Any environment that converts Markdown to PDF using the **md-to-pdf** library (all versions before 5.2.5) is at risk of exploitation.

The impact scope of **CVE-2025-65108** is not limited to web applications but extends to the entire ecosystem, including:

* Dev tools,
    
* Automation pipelines,
    
* Cloud services,
    
* Internal infrastructure.
    

Wherever untrusted Markdown is converted to PDF, this vulnerability can become a dangerous RCE vector.

## **Severity Assessment**

**CVE-2025-65108** is rated as **CRITICAL** with the following scores:

* **NIST**: NVD **Base Score**: N/A - NVD assessment not yet provided.
    
* **CNA**: Patchstack **Base Score**: 10.0 - CRITICAL **Vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    

## **Analysis and Exploitation of the Vulnerability**

First, as mentioned, the attacker will prepare an executable payload, and it can only occur when one of the following conditions is met:

* **A plugin/extension in the md-to-pdf pipeline is enabled**, and that plugin actively **executes** JavaScript code blocks in the Node context (for example, plugins like `remark-exec` / `rehype-run` or a custom plugin that calls `eval`, `vm.runInThisContext`, `new Function`, or `require` on the code block content).
    
* **md-to-pdf (or a dependency) contains a vulnerability** that allows injecting/executing Node code from the markdown content (for example, using a template engine with unsafe interpolation like `_.template` or `handlebars` without sanitizing).
    
* The user runs md-to-pdf with **custom configurations** that allow running hooks or scripts taken from the Markdown content.
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1764123235997/1f7ac34f-69bc-4d61-aafc-ce9264548566.png align="center")

After preparing a payload as mentioned, the attacker will introduce this file into the system in several ways: upload, commit PR, send an email, or pass it into an API. Here, when the user activates **md-to-pdf** to convert the file, the parser reads the front-matter and evaluates.

As you can see, `---javascript` and `---RCE` here are not standard front-matter (front-matter is usually `---\nkey: value\n---`) and are being exploited to execute the attack. The function `((require("child_process")).execSync("calc.exe"))` will be called - this is a JavaScript command running in the Node.js environment.

* `require("child_process")` gets the child\_process module.
    
* `.execSync("calc.exe")` runs the system command `calc.exe` synchronously - on Windows, this will open the Calculator. On Linux/Mac, this command will return an error if `calc.exe` does not exist.
    

The goal of the payload: if this JS code is **executed in the Node.js context** (not in the browser), it will call the subsystem and execute the command - which means local RCE (remote code execution). A dangerous point here is that if the server runs with high privileges (root/Administrator), the consequences are more severe (full system access).

Once an attacker has **executed code** on the system (e.g., RCE through the payload as you analyzed earlier), the **post-exploitation** steps usually aim to:

* **Maintain access**
    
* **Privilege escalation**
    
* **Cover tracks**
    
* **Gather information/data**
    
* **Expand reach**
    
* **Prepare for sabotage or deploy ransomware**
    

## **Recommendation**

1. **Update to md-to-pdf version ≥ 5.2.5**
    
    * Check the current version of md-to-pdf:
        
        * `npm list md-to-pdf`
            
        * `yarn list md-to-pdf`
            
    * Update using npm
        
        * `npm install md-to-pdf@^5.2.5`
            
        * `npm install md-to-pdf@latest`
            
    * Update using Yarn
        
        * `yarn add md-to-pdf@^5.2.5`
            
    * Update in package.json
        
        * `"md-to-pdf": "5.0.x"` => `"md-to-pdf": "^5.2.5"`
            
        * `npm install`
            
    * Update md-to-pdf in Docker or container
        
        * `RUN npm install md-to-pdf`
            
        * `docker build -t app:patched`
            
2. **Prevent untrusted Markdown processing**
    
    * Temporarily stop services that automatically convert Markdown to PDF if the input comes from external users.
        
    * Only process documents from trusted sources while waiting for updates.
        
3. **Use only trusted Markdown sources**
    
    * Do not download or open Markdown files (.md) from unclear sources.
        
    * Do not copy/paste strange Markdown content into PDF conversion systems.
        
    * Avoid using Markdown templates shared over the Internet if the source is not verified.
        
4. **Check front-matter before opening or uploading Markdown**
    
    * If you see sections like:
        
        ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1763975448483/8e366a7c-e628-4e52-9426-43e7ff5a2071.png align="center")
        
        ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1763975455177/ddf1a41f-5cf0-411f-a8aa-6ca87f26f1a2.png align="center")
        
        or content with unusual keywords such as:
        
        * `child_process`
            
        * `execSync`
            
        * `require(`
            
        * `process.mainModule`
            
    * **Stop processing immediately**, as this could be a payload designed to exploit an RCE vulnerability.
        
5. **Do not share or upload sensitive Markdown to untrusted online services**
    
    * Do not upload Markdown files containing internal information to free services that cannot be verified for safety.
        
    * Use the organization's official platform to create PDFs.
        

## **Summary**

The vulnerability **CVE-2025-65108** reveals an unsettling truth: even seemingly harmless tools like Markdown to PDF converters can become the starting point for a full-scale attack. Injecting JavaScript through front-matter and executing code within md-to-pdf has turned a simple document processing task into a serious RCE point, rated CVSS 10.0 – the highest possible level.

The impact spreads widely, from web applications to CI/CD pipelines, from cloud services to internal systems. This creates an urgent need to update versions, review the entire Markdown processing workflow, and apply safe isolation measures for document conversion tasks.

**CVE-2025-65108** is not just a vulnerability; it's a reminder that the line between "data" and "executable code" is always fragile. A single misconfiguration or an overlooked feature is enough for an attacker to turn a Markdown document into a weapon. Acting early is crucial to limit risks and protect systems from unforeseen consequences.

## **References**

1. [Critical Markdown to PDF Flaw (CVE-2025-65108, CVSS 10.0) Allows RCE via JS Injection in Markdown Front-Matter](https://securityonline.info/critical-markdown-to-pdf-flaw-cve-2025-65108-cvss-10-0-allows-rce-via-js-injection-in-markdown-front-matter/)
    
2. [NVD - CVE-2025-65108](https://nvd.nist.gov/vuln/detail/CVE-2025-65108)
    
3. [md-to-pdf vulnerable to arbitrary JavaScript code execution when parsing front matter · CVE-2025-65108 · GitHub Advisory Database · GitHub](https://github.com/advisories/GHSA-547r-qmjm-8hvw?utm_source=chatgpt.com)