CVE-2024-22778

The real-time collaborative note-taking application HackMD CodiMD is vulnerable to a Denial of Service (DoS) attack in versions prior to 2.5.2 . This vulnerability allows an attacker to disrupt the availability of the service. Remediation is available by updating to version 2.5.2 or later . Explo...

CVE-2024-38353

CVE-2024-38353 (CodiMD) affects CodiMD prior to 2.5.4, where an unauthenticated attacker can access uploaded image data due to missing authentication and access controls. The underlying issue is insecure filename generation in the Formidable library, enabling an attacker who can guess an image UR...

CVE-2024-38354

CVE-2024-38354 affects CodiMD/HackMD.io notes, where the notebook feature allows rendering of iframe HTML tags with an improperly sanitized name attribute, enabling DOM clobbering-based XSS. The issue, fixed in version 2.5.4, impacts note collaboration environments that render untrusted HTML. No ...