CVE-2025-58358: Markdownify Command Injection RCE Flaw

CVE-2025-58358 Overview

CVE-2025-58358 is a command injection vulnerability affecting Markdownify, a Model Context Protocol (MCP) server designed for converting various content formats to Markdown. Versions below 0.0.2 contain this critical flaw caused by the unsanitized use of input parameters within calls to child_process.exec, enabling attackers to inject arbitrary system commands. Successful exploitation can lead to remote code execution under the server process's privileges.

Critical Impact

Attackers can achieve remote code execution by injecting shell metacharacters into user-controlled input, potentially compromising the entire server and any connected systems.

Affected Products

• Markdownify MCP Server versions below 0.0.2

Discovery Timeline

• 2025-09-04 - CVE-2025-58358 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-58358

Vulnerability Analysis

This vulnerability falls under CWE-77 (Command Injection), a class of security weaknesses where an application constructs command strings using untrusted input without proper sanitization. In the case of Markdownify, the server constructs and executes shell commands using unvalidated user input directly within command-line strings passed to Node.js's child_process.exec function.

The child_process.exec function spawns a shell and executes the provided command within that shell context. When user-controlled data is concatenated directly into the command string without sanitization, attackers can break out of the intended command structure and execute arbitrary commands on the underlying operating system.

Root Cause

The root cause of this vulnerability is the direct interpolation of user-supplied input into shell command strings without proper input validation or sanitization. The application fails to escape or filter shell metacharacters before passing data to child_process.exec. This is a common anti-pattern in Node.js applications where developers use exec for convenience without considering the security implications of shell interpretation.

Safer alternatives such as child_process.execFile or child_process.spawn with explicit argument arrays would prevent shell metacharacter interpretation, as they do not invoke a shell to parse the command string.

Attack Vector

The attack vector is network-based, requiring user interaction. An attacker can exploit this vulnerability by providing specially crafted input containing shell metacharacters such as pipe (|), command chaining (&&, ;), output redirection (>), or command substitution (`command` or $(command)). When the server processes this malicious input and passes it to child_process.exec, the injected commands execute with the same privileges as the server process.

For example, an attacker could inject metacharacters to chain malicious commands that download and execute remote payloads, exfiltrate sensitive data, establish reverse shells, or modify system files. The impact is bounded only by the permissions of the server process and the attacker's creativity.

For technical details on the vulnerability and its remediation, see the GitHub Security Advisory GHSA-45qj-4xq3-3c45.

Detection Methods for CVE-2025-58358

Indicators of Compromise

• Unusual process spawning from the Markdownify server process, particularly shell commands containing metacharacters
• Unexpected outbound network connections from the server
• Anomalous file system activity or modifications in server directories
• Process execution logs showing commands with shell metacharacters (|, &&, ;, >, backticks)

Detection Strategies

• Monitor process execution chains for child processes spawned by the Markdownify MCP server with suspicious command-line arguments
• Implement application-layer logging to capture all user inputs being processed by the conversion functions
• Deploy endpoint detection and response (EDR) solutions to identify command injection patterns and anomalous process behavior
• Review server logs for requests containing shell metacharacters in input parameters

Monitoring Recommendations

• Enable verbose logging for the Markdownify server to capture all input processing events
• Configure SIEM rules to alert on shell metacharacter patterns in application logs
• Monitor for unusual network activity originating from the server process
• Implement file integrity monitoring on the server to detect unauthorized modifications

How to Mitigate CVE-2025-58358

Immediate Actions Required

• Upgrade Markdownify MCP Server to version 0.0.2 or later immediately
• If immediate upgrade is not possible, consider temporarily disabling the affected service until patching is complete
• Audit server logs for any signs of exploitation attempts
• Review network traffic logs for indicators of data exfiltration or reverse shell connections

Patch Information

The vulnerability has been fixed in Markdownify version 0.0.2. The fix involves proper sanitization of user input before use in shell commands. The patch details can be reviewed in the GitHub commit a31204de058b22a47e1dcc24508993cfe97e5bb3.

Organizations should update to the patched version by running their package manager update commands. For npm-based installations, run npm update markdownify-mcp or specify the fixed version explicitly in your package.json.

Workarounds

• Implement network-level access controls to restrict which clients can communicate with the Markdownify server
• Deploy a web application firewall (WAF) with rules to filter shell metacharacters from incoming requests
• Run the Markdownify server in a sandboxed environment or container with minimal privileges and restricted network access
• Implement input validation at the application or proxy layer to reject requests containing shell metacharacters

# Example: Running Markdownify in a restricted Docker container
docker run --read-only \
  --security-opt=no-new-privileges:true \
  --cap-drop=ALL \
  --network=internal-only \
  markdownify-mcp:0.0.2