Описание
Markdownify subject to Remote Code Execution via malicious markdown file
Markdownify version 1.4.1 allows an external attacker to execute arbitrary code remotely on any client attempting to view a malicious markdown file through Markdownify. This is possible because the application has the "nodeIntegration" option enabled. There are currently no patched versions and no known workarounds.
Пакеты
Наименование
electron-markdownify
npm
Затронутые версииВерсия исправления
<= 1.4.1
Отсутствует
Связанные уязвимости
CVSS3: 7.8
nvd
больше 3 лет назад
Markdownify version 1.4.1 allows an external attacker to execute arbitrary code remotely on any client attempting to view a malicious markdown file through Markdownify. This is possible because the application has the "nodeIntegration" option enabled.