vmd through 1.34.0 allows ‘div class=“markdown-body”’ XSS, as demonstrated by Electron remote code execution via require(‘child_process’).execSync(‘calc.exe’) on Windows and a similar attack on macOS.
nu11secur1ty at July 10, 2021 9:46pm UTC reported:
If someone malicious guy sends MD file with malicious content, and for example, the user is a real user ;) and don’t know what actually is going on, and open the file with VMD, boom, the game is over for him.
<https://streamable.com/j7e13y> – low
<https://streamable.com/oykc86> – medium
<https://streamable.com/yywb0h> – high
<https://streamable.com/ngx2xm> – very high
Assessed Attacker Value: 5
Assessed Attacker Value: 5Assessed Attacker Value: 3