Django REST framework

Lookup for vulnerabilities affecting packages.

Vulnerability_id VCID-epy5-zgac-qbeb

Summary

Improper Control of Generation of Code ('Code Injection')
The package md-to-pdf is vulnerable to Remote Code Execution (RCE) due to utilizing the library gray-matter to parse front matter content, without disabling the JS engine.

Aliases

alias	CVE-2021-23639

alias	GHSA-x949-7cm6-fm6p

Fixed_packages

url pkg:npm/md-to-pdf@5.0.0

purl pkg:npm/md-to-pdf@5.0.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-undq-xcm3-uqbu

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/md-to-pdf@5.0.0

Affected_packages

url pkg:npm/markdown_to_pdf@1.0.0

purl pkg:npm/markdown_to_pdf@1.0.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-epy5-zgac-qbeb

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/markdown_to_pdf@1.0.0

url pkg:npm/markdown_to_pdf@1.1.0

purl pkg:npm/markdown_to_pdf@1.1.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-epy5-zgac-qbeb

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/markdown_to_pdf@1.1.0

url pkg:npm/markdown_to_pdf@1.2.0

purl pkg:npm/markdown_to_pdf@1.2.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-epy5-zgac-qbeb

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/markdown_to_pdf@1.2.0

url pkg:npm/markdown_to_pdf@1.2.1

purl pkg:npm/markdown_to_pdf@1.2.1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-epy5-zgac-qbeb

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/markdown_to_pdf@1.2.1

url pkg:npm/markdown_to_pdf@1.3.0

purl pkg:npm/markdown_to_pdf@1.3.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-epy5-zgac-qbeb

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/markdown_to_pdf@1.3.0

url pkg:npm/md-to-pdf@1.0.0

purl pkg:npm/md-to-pdf@1.0.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-epy5-zgac-qbeb

vulnerability	VCID-undq-xcm3-uqbu

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/md-to-pdf@1.0.0

url pkg:npm/md-to-pdf@1.0.1

purl pkg:npm/md-to-pdf@1.0.1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-epy5-zgac-qbeb

vulnerability	VCID-undq-xcm3-uqbu

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/md-to-pdf@1.0.1

url pkg:npm/md-to-pdf@1.0.2

purl pkg:npm/md-to-pdf@1.0.2

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-epy5-zgac-qbeb

vulnerability	VCID-undq-xcm3-uqbu

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/md-to-pdf@1.0.2

url pkg:npm/md-to-pdf@1.1.0

purl pkg:npm/md-to-pdf@1.1.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-epy5-zgac-qbeb

vulnerability	VCID-undq-xcm3-uqbu

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/md-to-pdf@1.1.0

url pkg:npm/md-to-pdf@2.1.4

purl pkg:npm/md-to-pdf@2.1.4

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-epy5-zgac-qbeb

vulnerability	VCID-undq-xcm3-uqbu

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/md-to-pdf@2.1.4

url pkg:npm/md-to-pdf@2.1.5

purl pkg:npm/md-to-pdf@2.1.5

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-epy5-zgac-qbeb

vulnerability	VCID-undq-xcm3-uqbu

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/md-to-pdf@2.1.5

url pkg:npm/md-to-pdf@2.2.0

purl pkg:npm/md-to-pdf@2.2.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-epy5-zgac-qbeb

vulnerability	VCID-undq-xcm3-uqbu

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/md-to-pdf@2.2.0

url pkg:npm/md-to-pdf@2.3.0

purl pkg:npm/md-to-pdf@2.3.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-epy5-zgac-qbeb

vulnerability	VCID-undq-xcm3-uqbu

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/md-to-pdf@2.3.0

url pkg:npm/md-to-pdf@2.3.1

purl pkg:npm/md-to-pdf@2.3.1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-epy5-zgac-qbeb

vulnerability	VCID-undq-xcm3-uqbu

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/md-to-pdf@2.3.1

url pkg:npm/md-to-pdf@2.3.2

purl pkg:npm/md-to-pdf@2.3.2

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-epy5-zgac-qbeb

vulnerability	VCID-undq-xcm3-uqbu

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/md-to-pdf@2.3.2

url pkg:npm/md-to-pdf@2.4.0

purl pkg:npm/md-to-pdf@2.4.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-epy5-zgac-qbeb

vulnerability	VCID-undq-xcm3-uqbu

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/md-to-pdf@2.4.0

url pkg:npm/md-to-pdf@2.4.1

purl pkg:npm/md-to-pdf@2.4.1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-epy5-zgac-qbeb

vulnerability	VCID-undq-xcm3-uqbu

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/md-to-pdf@2.4.1

url pkg:npm/md-to-pdf@2.4.2

purl pkg:npm/md-to-pdf@2.4.2

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-epy5-zgac-qbeb

vulnerability	VCID-undq-xcm3-uqbu

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/md-to-pdf@2.4.2

url pkg:npm/md-to-pdf@2.5.0

purl pkg:npm/md-to-pdf@2.5.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-epy5-zgac-qbeb

vulnerability	VCID-undq-xcm3-uqbu

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/md-to-pdf@2.5.0

url pkg:npm/md-to-pdf@2.6.0

purl pkg:npm/md-to-pdf@2.6.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-epy5-zgac-qbeb

vulnerability	VCID-undq-xcm3-uqbu

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/md-to-pdf@2.6.0

url pkg:npm/md-to-pdf@2.6.1

purl pkg:npm/md-to-pdf@2.6.1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-epy5-zgac-qbeb

vulnerability	VCID-undq-xcm3-uqbu

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/md-to-pdf@2.6.1

url pkg:npm/md-to-pdf@2.6.2

purl pkg:npm/md-to-pdf@2.6.2

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-epy5-zgac-qbeb

vulnerability	VCID-undq-xcm3-uqbu

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/md-to-pdf@2.6.2

url pkg:npm/md-to-pdf@2.6.3

purl pkg:npm/md-to-pdf@2.6.3

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-epy5-zgac-qbeb

vulnerability	VCID-undq-xcm3-uqbu

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/md-to-pdf@2.6.3

url pkg:npm/md-to-pdf@2.6.4

purl pkg:npm/md-to-pdf@2.6.4

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-epy5-zgac-qbeb

vulnerability	VCID-undq-xcm3-uqbu

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/md-to-pdf@2.6.4

url pkg:npm/md-to-pdf@2.7.0

purl pkg:npm/md-to-pdf@2.7.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-epy5-zgac-qbeb

vulnerability	VCID-undq-xcm3-uqbu

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/md-to-pdf@2.7.0

url pkg:npm/md-to-pdf@2.7.1

purl pkg:npm/md-to-pdf@2.7.1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-epy5-zgac-qbeb

vulnerability	VCID-undq-xcm3-uqbu

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/md-to-pdf@2.7.1

url pkg:npm/md-to-pdf@2.8.0

purl pkg:npm/md-to-pdf@2.8.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-epy5-zgac-qbeb

vulnerability	VCID-undq-xcm3-uqbu

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/md-to-pdf@2.8.0

url pkg:npm/md-to-pdf@2.8.1

purl pkg:npm/md-to-pdf@2.8.1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-epy5-zgac-qbeb

vulnerability	VCID-undq-xcm3-uqbu

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/md-to-pdf@2.8.1

url pkg:npm/md-to-pdf@2.8.2

purl pkg:npm/md-to-pdf@2.8.2

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-epy5-zgac-qbeb

vulnerability	VCID-undq-xcm3-uqbu

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/md-to-pdf@2.8.2

url pkg:npm/md-to-pdf@3.0.0-pre.0

purl pkg:npm/md-to-pdf@3.0.0-pre.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-epy5-zgac-qbeb

vulnerability	VCID-undq-xcm3-uqbu

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/md-to-pdf@3.0.0-pre.0

url pkg:npm/md-to-pdf@3.0.0-pre.1

purl pkg:npm/md-to-pdf@3.0.0-pre.1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-epy5-zgac-qbeb

vulnerability	VCID-undq-xcm3-uqbu

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/md-to-pdf@3.0.0-pre.1

url pkg:npm/md-to-pdf@3.0.0

purl pkg:npm/md-to-pdf@3.0.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-epy5-zgac-qbeb

vulnerability	VCID-undq-xcm3-uqbu

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/md-to-pdf@3.0.0

url pkg:npm/md-to-pdf@3.0.1

purl pkg:npm/md-to-pdf@3.0.1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-epy5-zgac-qbeb

vulnerability	VCID-undq-xcm3-uqbu

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/md-to-pdf@3.0.1

url pkg:npm/md-to-pdf@3.1.0

purl pkg:npm/md-to-pdf@3.1.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-epy5-zgac-qbeb

vulnerability	VCID-undq-xcm3-uqbu

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/md-to-pdf@3.1.0

url pkg:npm/md-to-pdf@3.1.1

purl pkg:npm/md-to-pdf@3.1.1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-epy5-zgac-qbeb

vulnerability	VCID-undq-xcm3-uqbu

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/md-to-pdf@3.1.1

url pkg:npm/md-to-pdf@3.1.2

purl pkg:npm/md-to-pdf@3.1.2

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-epy5-zgac-qbeb

vulnerability	VCID-undq-xcm3-uqbu

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/md-to-pdf@3.1.2

url pkg:npm/md-to-pdf@3.2.1

purl pkg:npm/md-to-pdf@3.2.1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-epy5-zgac-qbeb

vulnerability	VCID-undq-xcm3-uqbu

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/md-to-pdf@3.2.1

url pkg:npm/md-to-pdf@3.3.0

purl pkg:npm/md-to-pdf@3.3.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-epy5-zgac-qbeb

vulnerability	VCID-undq-xcm3-uqbu

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/md-to-pdf@3.3.0

url pkg:npm/md-to-pdf@3.3.1

purl pkg:npm/md-to-pdf@3.3.1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-epy5-zgac-qbeb

vulnerability	VCID-undq-xcm3-uqbu

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/md-to-pdf@3.3.1

url pkg:npm/md-to-pdf@3.3.2

purl pkg:npm/md-to-pdf@3.3.2

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-epy5-zgac-qbeb

vulnerability	VCID-undq-xcm3-uqbu

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/md-to-pdf@3.3.2

url pkg:npm/md-to-pdf@4.0.0

purl pkg:npm/md-to-pdf@4.0.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-epy5-zgac-qbeb

vulnerability	VCID-undq-xcm3-uqbu

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/md-to-pdf@4.0.0

url pkg:npm/md-to-pdf@4.0.1

purl pkg:npm/md-to-pdf@4.0.1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-epy5-zgac-qbeb

vulnerability	VCID-undq-xcm3-uqbu

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/md-to-pdf@4.0.1

url pkg:npm/md-to-pdf@4.1.0

purl pkg:npm/md-to-pdf@4.1.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-epy5-zgac-qbeb

vulnerability	VCID-undq-xcm3-uqbu

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/md-to-pdf@4.1.0

References

reference_url

https://api.first.org/data/v1/epss?cve=CVE-2021-23639

reference_id

reference_type

scores

value	0.19908
scoring_system	epss
scoring_elements	0.95588
published_at	2026-06-06T12:55:00Z

value	0.19908
scoring_system	epss
scoring_elements	0.95591
published_at	2026-06-08T12:55:00Z

value	0.19908
scoring_system	epss
scoring_elements	0.9559
published_at	2026-06-07T12:55:00Z

value	0.19908
scoring_system	epss
scoring_elements	0.95585
published_at	2026-06-05T12:55:00Z

value	0.19908
scoring_system	epss
scoring_elements	0.95578
published_at	2026-06-04T12:55:00Z

url

https://api.first.org/data/v1/epss?cve=CVE-2021-23639

reference_url

https://github.com/simonhaenisch/md-to-pdf

reference_id

reference_type

scores

value	9.8
scoring_system	cvssv3.1
scoring_elements	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

value	CRITICAL
scoring_system	generic_textual
scoring_elements

url

https://github.com/simonhaenisch/md-to-pdf

reference_url

https://github.com/simonhaenisch/md-to-pdf/commit/a716259c548c82fa1d3b14a3422e9100619d2d8a

reference_id

reference_type

scores

value	9.8
scoring_system	cvssv3.1
scoring_elements	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

value	CRITICAL
scoring_system	generic_textual
scoring_elements

url

https://github.com/simonhaenisch/md-to-pdf/commit/a716259c548c82fa1d3b14a3422e9100619d2d8a

reference_url

https://github.com/simonhaenisch/md-to-pdf/issues/99

reference_id

reference_type

scores

value	9.8
scoring_system	cvssv3.1
scoring_elements	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

value	CRITICAL
scoring_system	generic_textual
scoring_elements

url

https://github.com/simonhaenisch/md-to-pdf/issues/99

reference_url

https://snyk.io/vuln/SNYK-JS-MDTOPDF-1657880

reference_id

reference_type

scores

value	9.8
scoring_system	cvssv3.1
scoring_elements	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

value	CRITICAL
scoring_system	generic_textual
scoring_elements

url

https://snyk.io/vuln/SNYK-JS-MDTOPDF-1657880

reference_url

https://nvd.nist.gov/vuln/detail/CVE-2021-23639

reference_id

CVE-2021-23639

reference_type

scores

value	9.8
scoring_system	cvssv3.1
scoring_elements	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

value	CRITICAL
scoring_system	generic_textual
scoring_elements

url

https://nvd.nist.gov/vuln/detail/CVE-2021-23639

reference_url

https://github.com/advisories/GHSA-x949-7cm6-fm6p

reference_id

GHSA-x949-7cm6-fm6p

reference_type

scores

value	CRITICAL
scoring_system	cvssv3.1_qr
scoring_elements

url

https://github.com/advisories/GHSA-x949-7cm6-fm6p

Weaknesses

cwe_id	1035
name	OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.

cwe_id	937
name	OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.

cwe_id	94
name	Improper Control of Generation of Code ('Code Injection')
description	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

cwe_id	78
name	Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
description	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Exploits

Severity_range_score 9.0 - 10.0

Exploitability 0.5

Weighted_severity 9.0

Risk_score 4.5

Resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-epy5-zgac-qbeb

Vulnerability Instance