CVE-2023-2318 MarkText DOM-Based Cross-site Scripting leading to Remote Code Execution

DOM-based XSS in src/muya/lib/contentState/pasteCtrl.js in MarkText 0.17.1 and before on Windows, Linux and macOS allows arbitrary JavaScript code to run in the context of MarkText main window. This vulnerability can be exploited if a user copies text from a malicious webpage and paste it into...

CVE-2023-2318

CVE-2023-2318 concerns MarkText up to version 0.17.1 where a DOM‑based XSS flaw in src/muya/lib/contentState/pasteCtrl.js can allow arbitrary JavaScript to run in the MarkText main window when pasting HTML copied from a malicious page. The vulnerability arises during HTML-to-Markdown conversion: ...

MarkText 跨站脚本漏洞

MarkText is a simple and elegant open source Markdown editor focused on speed and usability. A security vulnerability exists in MarkText version 0.17.1, originating in the src/muya/lib/contentState/pasteCtrl.js file, which can be exploited by copying and pasting text from a malicious web page int...

CVE-2023-1004

A vulnerability has been found in MarkText up to 0.17.1 on Windows and classified as critical. Affected by this vulnerability is an unknown functionality of the component WSH JScript Handler. The manipulation leads to code injection. Local access is required to approach this attack. The exploit h...

Code injection

A vulnerability has been found in MarkText up to 0.17.1 on Windows and classified as critical. Affected by this vulnerability is an unknown functionality of the component WSH JScript Handler. The manipulation leads to code injection. Local access is required to approach this attack. The exploit h...

CVE-2023-1004

MarkText up to version 0.17.1 on Windows is affected by CVE-2023-1004, with a vulnerability in the WSH JScript Handler that enables code injection. The issue requires local access and has publicly disclosed exploit information. The advisory lists update to a version later than 0.17.1 as the remed...

CVE-2023-1004 MarkText WSH JScript code injection

A vulnerability has been found in MarkText up to 0.17.1 on Windows and classified as critical. Affected by this vulnerability is an unknown functionality of the component WSH JScript Handler. The manipulation leads to code injection. Local access is required to approach this attack. The exploit h...

CVE-2023-1004 MarkText WSH JScript code injection

A vulnerability has been found in MarkText up to 0.17.1 on Windows and classified as critical. Affected by this vulnerability is an unknown functionality of the component WSH JScript Handler. The manipulation leads to code injection. Local access is required to approach this attack. The exploit h...

CVE-2023-1004 MarkText WSH JScript code injection

A vulnerability has been found in MarkText up to 0.17.1 on Windows and classified as critical. Affected by this vulnerability is an unknown functionality of the component WSH JScript Handler. The manipulation leads to code injection. Local access is required to approach this attack. The exploit h...

PT-2023-16681 · Microsoft +1 · Wsh Jscript Handler +1

Name of the Vulnerable Software and Affected Versions: MarkText versions up to 0.17.1 Description: A critical vulnerability has been found in MarkText, affecting an unknown functionality of the component WSH JScript Handler. The manipulation leads to code injection, requiring local access to...

MarkText 代码注入漏洞

MarkText is a simple and elegant open source Markdown editor focused on speed and usability. A code injection vulnerability exists in MarkText version 0.17.1 and earlier versions. An attacker can exploit this vulnerability to inject arbitrary code...

CVE-2022-21158

A stored cross-site scripting vulnerability in marktext versions prior to v0.17.0 due to improper handling of the link with javascript: scheme inside the document may allow an attacker to execute an arbitrary script on the PC of the user using marktext...

Cross site scripting

A stored cross-site scripting vulnerability in marktext versions prior to v0.17.0 due to improper handling of the link with javascript: scheme inside the document may allow an attacker to execute an arbitrary script on the PC of the user using marktext...

CVE-2022-21158

A stored cross-site scripting vulnerability in marktext versions prior to v0.17.0 due to improper handling of the link with javascript: scheme inside the document may allow an attacker to execute an arbitrary script on the PC of the user using marktext...

CVE-2022-21158

CVE-2022-21158 is a stored XSS flaw in MarkText, affecting versions prior to 0.17.0. The issue stems from improper handling of links using the javascript: scheme inside documents, enabling an attacker to execute arbitrary scripts on a user’s PC. The vulnerability is addressed by updating to v0.17...

CVE-2022-21158

A stored cross-site scripting vulnerability in marktext versions prior to v0.17.0 due to improper handling of the link with javascript: scheme inside the document may allow an attacker to execute an arbitrary script on the PC of the user using marktext...

MarkText Cross-Site Scripting Vulnerability

MarkText is a simple and elegant Markdown editor with a focus on speed and usability.A cross-site scripting vulnerability exists in versions of MarkText prior to 0.17.0, which stems from improper handling of links using javascript:scheme in documents. A remote attacker could exploit this...

MarkText 跨站脚本漏洞

MarkText is a simple and elegant Markdown editor with a focus on speed and usability.A cross-site scripting vulnerability exists in versions of MarkText prior to 0.17.0, which stems from improper handling of links using javascript:scheme in documents. A remote attacker could exploit this...

JVN#89524240: MarkText vulnerable to cross-site scripting

MarkText is a Markdown editor. MarkText contains a cross-site scripting vulnerability CWE-79. Impact An arbitrary script may be executed on the PC of the user using the product. Solution Update the Software Update the software to the latest version according to the information provided by the...

CVE-2022-24123

MarkText through 0.16.3 does not sanitize the input of a mermaid block before rendering. This could lead to Remote Code Execution via a .md file containing a mutation Cross-Site Scripting XSS payload...