CVE-2023-0835: markdown-pdf_project markdown-pdf Cross-site Scripting
CVSS: 8.2v3.1HighModified
AliasesGHSA-qghr-877h-f9jh
Published 04-04-2023Last modified 03-12-2025
Vulnerability summary
CVE-2023-0835 is a high (CVSS 8.2) Cross-site Scripting vulnerability in markdown-pdf_project markdown-pdf. EPSS estimates a 0.60% chance of exploitation in the next 30 days, higher than 47.5% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
8.2/10
010
High · v3.1 (CVE.org)EPSS score
0.60%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference
Timeline
- 04-04-2023PublishedVulnerability first disclosed.
- 03-12-2025Last modifiedVulnerability information updated.
Description
markdown-pdf version 11.0.0 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate the Markdown content entered by the user.
CVSS metrics
3 scores · 3 sources · 1 versionHigh 8.2Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:NSources3 sources · 7.5–8.2
- OSV · NpmEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NDiffers
- NVDNIST8.2HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
EPSS trend
Probability
0.60%
Chance of exploitation in the next 30 days
Percentile
48%
Versus all other CVEs
30-day change
0.00 pp
From 0.60% on 19-09-2026
19-09-202619-10-2026
EPSS score0.60%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (fluidattacks.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Markdown-pdf_project1 product
- markdown-pdf11.0.0
Npm1 product
- markdown-pdf≤ 11.0.0
2 vendors · 2 products
