CVE-2022-41709

2022-10-1900:00:00

Fluid Attacks

www.cve.org

markdownify

remote code execution

malicious markdown file

nodeintegration

0.001 Low

EPSS

Percentile

33.5%

JSON

Markdownify version 1.4.1 allows an external attacker to execute arbitrary code remotely on any client attempting to view a malicious markdown file through Markdownify. This is possible because the application has the “nodeIntegration” option enabled.

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "Markdownify",
    "versions": [
      {
        "version": "1.4.1",
        "status": "affected"
      }
    ]
  }
]

References

fluidattacks.com/advisories/adams/

github.com/amitmerchant1990/electron-markdownify

0.001 Low

EPSS

Percentile

33.5%

JSON

Related for CVELIST:CVE-2022-41709