CVE-2024-33300

2024-05-0100:00:00

mitre

github.com

typora

markdown

xss

vulnerability

arbitrary code

upload

AI Score

6.5

Confidence

High

SSVC

Exploitation

poc

Automatable

Technical Impact

partial

JSON

Typora v1.0.0 through v1.7 version (below) Markdown editor has a cross-site scripting (XSS) vulnerability, which allows attackers to execute arbitrary code by uploading Markdown files.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:typora:typora:*:*:*:*:*:*:*:*"
    ],
    "vendor": "typora",
    "product": "typora",
    "versions": [
      {
        "status": "affected",
        "version": "*"
      }
    ],
    "defaultStatus": "unknown"
  }
]