lov-any2pdf
Warn
Audited by Socket on Oct 3, 2026
1 alert found:
AnomalyAnomalyscripts/md2pdf.py
LOWAnomalyLOW
scripts/md2pdf.py
The code is a document-rendering utility with no clear malware indicators or covert data-theft behavior. The primary security concern is network and local-file access through user-controlled image sources: arbitrary HTTP(S) URLs can cause server-side requests, and file:// or local paths can cause accessible files to be embedded in the output PDF. Restrict image schemes and hosts, enforce response-size limits, validate image content, and sandbox or disable remote images when processing untrusted Markdown. The provided fragment also appears truncated or syntactically invalid at the final main( call.
Confidence: 98%Severity: 58%
Audit Metadata