CVE-2023-0835

markdown-pdf version 11.0.0 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate the Markdown content entered by the user.

Score

CVSS 3.1 8.2 High

Status

Modified - help@fluidattacks.com

Published

2023-04-04

Last modified

2025-12-03

Weaknesses

CWE-79

Affected products

• Markdown-pdf (Markdown-pdf Project)

References

• https://fluidattacks.com/advisories/relsb/
• https://www.npmjs.com/package/markdown-pdf/