{"action":"Upgrade mcp-markdownify-server to 0.0.2 or later.","affected":[{"fixed":"0.0.2","introduced":"0"}],"component":"mcp-markdownify-server","cve_ids":["CVE-2025-58358"],"ecosystem":"npm","epss":0.00965,"exploited":false,"fixed_versions":["0.0.2"],"ghsa_id":"GHSA-45qj-4xq3-3c45","id":"tcs_01M5KEZE91QEJ3FTNJW6SQPY4Q","modified_at":"2025-09-04T13:52:30Z","published_at":"2025-09-02T17:40:01Z","references":["https://osv.dev/vulnerability/GHSA-45qj-4xq3-3c45","https://github.com/zcaceres/markdownify-mcp/security/advisories/GHSA-45qj-4xq3-3c45","https://nvd.nist.gov/vuln/detail/CVE-2025-58358","https://github.com/zcaceres/markdownify-mcp/commit/a31204de058b22a47e1dcc24508993cfe97e5bb3","https://github.com/zcaceres/markdownify-mcp"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-45qj-4xq3-3c45","url":"https://osv.dev/vulnerability/GHSA-45qj-4xq3-3c45"}],"summary":"mcp-markdownify-server vulnerable to command injection in pptx-to-markdown tool"}