v2.2.0

Security

Fixes a high severity local file disclosure and SSRF vulnerability (GHSA-r476-vv4c-fhqx). In earlier versions, markdown passed to create_pdf_from_markdown could read local files into the generated PDF and make requests from the server to arbitrary hosts. Prompt-injected content (a web page or document an agent converts) could trigger this. All versions before 2.2.0 are affected; please upgrade.

Thanks to @Zureno for the responsible disclosure.

What changed:

• Rendering is self-contained: the browser may load only the document itself and data: URIs. Local file reads and outbound requests are blocked.
• Raw HTML in markdown is no longer passed through.
• Mermaid is bundled with the package (10.9.8) instead of loaded from a CDN.

Breaking: images

Images from arbitrary local paths or external URLs no longer load by default. Three ways to include images:

1. Base64 data: URIs, no configuration needed.
2. Set M2P_ASSETS_DIR and reference images by relative path (![chart](chart.png)). Only files inside that directory load.
3. Start the server with --dangerously-allow-images to restore the old behavior. Only do this if every piece of markdown the server receives is trusted.

See Images in the README.

Fixes

• A directory in outputFilename is now honored. Absolute paths are used as-is, and relative paths go under M2P_OUTPUT_DIR (or your home directory). Previously the directory was doubled or appended (#9, thanks @SamKr).
• The reported output path now matches the actual file when a name is incremented (report-1.pdf).
• A normal browser shutdown no longer logs a false crash error.

Upgrade

npx -y markdown2pdf-mcp@latest

Full details in the CHANGELOG.