[markdown-pdf] markdown-pdf vulnerable to local file read via server side cross-site scripting (XSS)

markdown-pdf version 11.0.0 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate the Markdown content entered by the user.

References

• https://nvd.nist.gov/vuln/detail/CVE-2023-0835
• https://fluidattacks.com/advisories/relsb/
• https://www.npmjs.com/package/markdown-pdf/
• https://github.com/advisories/GHSA-qghr-877h-f9jh