EPSS
Percentile
52.5%
gitnote 3.1.0 allows remote attackers to execute arbitrary code via a crafted Markdown file, as demonstrated by a javascript:window.parent.top.require(βchild_processβ).execFile substring in the onerror attribute of an IMG element.
github.com/CCCCCrash/POCs/tree/master/Web/gitnote
github.com/zhaopengme/gitnote/issues/209