Code injection

Markdownify version 1.4.1 allows an external attacker to execute arbitrary code remotely on any client attempting to view a malicious markdown file through Markdownify. This is possible because the application has the "nodeIntegration" option enabled...

CVE-2022-41709

Markdownify version 1.4.1 allows an external attacker to execute arbitrary code remotely on any client attempting to view a malicious markdown file through Markdownify. This is possible because the application has the "nodeIntegration" option enabled...

CVE-2022-41709: Inclusion of Functionality from Untrusted Control Sphere

Markdownify version 1.4.1 allows an external attacker to execute arbitrary code remotely on any client attempting to view a malicious markdown file through Markdownify. This is possible because the application has the "nodeIntegration" option enabled...

CVE-2022-41709

Markdownify version 1.4.1 allows an external attacker to execute arbitrary code remotely on any client attempting to view a malicious markdown file through Markdownify. This is possible because the application has the "nodeIntegration" option enabled...

CVE-2022-41709

Markdownify version 1.4.1 allows an external attacker to execute arbitrary code remotely on any client attempting to view a malicious markdown file through Markdownify. This is possible because the application has the "nodeIntegration" option enabled...

PT-2022-26038 · Unknown · Markdownify

Name of the Vulnerable Software and Affected Versions: Markdownify version 1.4.1 Description: The issue allows an external attacker to execute arbitrary code remotely on any client attempting to view a malicious markdown file through Markdownify. This is possible because the application has the...

Code injection

Gridea version 0.9.3 allows an external attacker to execute arbitrary code remotely on any client attempting to view a malicious markdown file through Gridea. This is possible because the application has the 'nodeIntegration' option enabled...

CVE-2022-40274

CVE-2022-40274 affects Gridea 0.9.3. The root cause is the application running with nodeIntegration enabled, allowing an attacker to remotely execute arbitrary code when a user views a malicious Markdown file. Impact is described as high in multiple sources. The documentation does not indicate a ...

CVE-2022-40274

Gridea version 0.9.3 allows an external attacker to execute arbitrary code remotely on any client attempting to view a malicious markdown file through Gridea. This is possible because the application has the 'nodeIntegration' option enabled...

CVE-2022-40274

Gridea version 0.9.3 allows an external attacker to execute arbitrary code remotely on any client attempting to view a malicious markdown file through Gridea. This is possible because the application has the 'nodeIntegration' option enabled...

PT-2022-25313 · Gridea · Gridea

Name of the Vulnerable Software and Affected Versions: Gridea version 0.9.3 Description: The issue allows an external attacker to execute arbitrary code remotely on any client attempting to view a malicious markdown file through Gridea. This is possible because the application has the...

CVE-2022-40274: Improper Control of Generation of Code

Gridea version 0.9.3 allows an external attacker to execute arbitrary code remotely on any client attempting to view a malicious markdown file through Gridea. This is possible because the application has the 'nodeIntegration' option enabled...

CVE-2022-25224

Proton v0.2.0 allows an attacker to create a malicious link inside a markdown file. When the victim clicks the link, the application opens the site in the current frame allowing an attacker to host JavaScript code in the malicious link in order to trigger an XSS attack. The 'nodeIntegration'...

CVE-2022-25229: Improper Neutralization of Input During Web Page Generation

Popcorn Time 0.4.7 has a Stored XSS in the 'Movies API Servers' field via the 'settings' page. The 'nodeIntegration' configuration is set to on which allows the 'webpage' to use 'NodeJs' features, an attacker can leverage this to run OS commands...

Joplin Vulnerable to Cross-site Scripting in Note Content

Joplin version prior to 1.0.90 contains a Cross-site Scripting XSS evolving into code execution due to enabled nodeIntegration for that particular BrowserWindow instance where XSS was identified from vulnerability in Note content field - information on the fix can be found here...

GHSA-M6MF-HMRH-PH4J Joplin Vulnerable to Cross-site Scripting in Note Content

Joplin version prior to 1.0.90 contains a Cross-site Scripting XSS evolving into code execution due to enabled nodeIntegration for that particular BrowserWindow instance where XSS was identified from vulnerability in Note content field - information on the fix can be found here...

@ftnk/electron-prebuilt-compile (1.7.3), downloadbycurl (1.0.0) +6 more potentially affected by CVE-2017-1000424 via electron (>=1.7.0, <=1.7.5)

electron NPM version =1.7.0, =1.7.0, =1.0.0, =0.0.1, =1.1.2, =1.3.2 Source cves: CVE-2017-1000424 Source advisory: OSV:GHSA-6H98-CF9G-VMG2...

@capacitor-community/electron-core (>=0.0.2, <=1.0.1), @felixrieseberg/electron-prebuilt-compile (>=9.0.0-beta.1, <=9.3.5) +18 more potentially affected by CVE-2020-26272 via electron (>=9.0.0, <=9.3.5)

electron NPM version =9.0.0, =0.0.2, =9.0.0-beta.1, =5.0.0-1, =5.9.2, =0.8.2, =0.1.1, =0.3.218, =0.2.9, =3.0.7, =9.0.0, =1.1.52, =2.0.0 and more Source cves: CVE-2020-26272 Source advisory: OSV:GHSA-HVF8-H2QH-37M9...

Design/Logic Flaw

zonote through 0.4.0 allows XSS via a crafted note, with resultant Remote Code Execution because nodeIntegration in webPreferences is true...

CVE-2020-35717: Improper Neutralization of Input During Web Page Generation

zonote through 0.4.0 allows XSS via a crafted note, with resultant Remote Code Execution because nodeIntegration in webPreferences is true...