Skip to content
OpenAdvisories

Package · npm

mcp-markdownify-server

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • High 7.5
    CVE-2025-58358

    Markdownify is vulnerable to command injection through pptx-to-markdown tool

    Markdownify is a Model Context Protocol server for converting almost anything to Markdown. Versions below 0.0.2 contain a command injection vulnerability, caused by the unsanitized use of input parameters within a call to child_process.exec, enabling an attac…

    zcaceres markdownify-mcp mcp-markdownify-server npm
  • High 7.4
    CVE-2025-5276

    Markdownify MCP Server allows Server-Side Request Forgery (SSRF) via the Markdownify.get() function

    Versions of the package mcp-markdownify-server before 1.0.0 are vulnerable to Server-Side Request Forgery (SSRF) via the Markdownify.get() function. An attacker can craft a prompt that, once accessed by the MCP host, can invoke the webpage-to-markdown, bing-s…

    mcp-markdownify-server npm
  • Medium 6.5
    CVE-2025-5273

    Markdownify MCP Server allows attackers to read arbitrary files

    Versions of the package mcp-markdownify-server before 1.0.0 are vulnerable to Files or Directories Accessible to External Parties via the get-markdown-file tool. An attacker can craft a prompt that, once accessed by the MCP host, will allow it to read arbitra…

    mcp-markdownify-server npm