Code injection

2022-10-1917:15:00

PRIOn knowledge base

www.prio-n.com

code injection

remote execution

markdownify vulnerability

nodeintegration option

0.001 Low

EPSS

Percentile

33.5%

JSON

Markdownify version 1.4.1 allows an external attacker to execute arbitrary code remotely on any client attempting to view a malicious markdown file through Markdownify. This is possible because the application has the “nodeIntegration” option enabled.

CPENameOperatorVersion
markdownifyeq1.4.1

CPE	Name	Operator	Version
	markdownify	eq	1.4.1

References

fluidattacks.com/advisories/adams/

github.com/amitmerchant1990/electron-markdownify

0.001 Low

EPSS

Percentile

33.5%

JSON

Related for PRION:CVE-2022-41709