CVE-2019-12138

MacDown 0.7.1 is affected by CVE-2019-12138, which allows directory traversal leading to execution of arbitrary programs via a file:/// or ../ substring in a shared note. Red Hat notes remote/code execution potential via a file:\ URI with a .app pathname in an A element’s HREF (distinct from CVE-...

CVE-2019-12173

MacDown 0.7.1 is affected by CVE-2019-12173. The Red Hat advisory and OSV records describe a remote code execution path triggered by a file:\ URI with a ".app" pathname in the HREF of an A element, enabling arbitrary code execution if a crafted note is opened. Affected component is the MacDown vi...