{"action":"Upgrade md-to-pdf to 5.2.5 or later.","affected":[{"fixed":"5.2.5","introduced":"0"}],"component":"md-to-pdf","cve_ids":["CVE-2025-65108"],"ecosystem":"npm","epss":0.0096,"exploited":false,"fixed_versions":["5.2.5"],"ghsa_id":"GHSA-547r-qmjm-8hvw","id":"tcs_01M5KF2GVFRDQ1CYATCRPGH3RF","modified_at":"2025-11-25T19:48:40Z","published_at":"2025-11-20T17:48:11Z","references":["https://osv.dev/vulnerability/GHSA-547r-qmjm-8hvw","https://github.com/simonhaenisch/md-to-pdf/security/advisories/GHSA-547r-qmjm-8hvw","https://nvd.nist.gov/vuln/detail/CVE-2025-65108","https://github.com/simonhaenisch/md-to-pdf/commit/46bdcf2051c8d1758b391c1353185a179a47a4d9","https://github.com/simonhaenisch/md-to-pdf"],"severity":{"label":"critical","score":10},"sources":[{"source":"osv","source_id":"GHSA-547r-qmjm-8hvw","url":"https://osv.dev/vulnerability/GHSA-547r-qmjm-8hvw"}],"summary":"md-to-pdf vulnerable to arbitrary JavaScript code execution when parsing front matter"}