Описание
Markdownify version 1.4.1 allows an external attacker to execute arbitrary code remotely on any client attempting to view a malicious markdown file through Markdownify. This is possible because the application has the "nodeIntegration" option enabled.
Ссылки
- ExploitThird Party Advisory
- Third Party Advisory
- ExploitThird Party Advisory
- Third Party Advisory
Уязвимые конфигурации
Конфигурация 1
cpe:2.3:a:markdownify_project:markdownify:1.4.1:*:*:*:*:*:*:*
EPSS
Процентиль: 23%
0.00077
Низкий
7.8 High
CVSS3
Дефекты
NVD-CWE-noinfo
CWE-829
Связанные уязвимости
CVSS3: 7.8
github
больше 3 лет назад
Markdownify subject to Remote Code Execution via malicious markdown file
EPSS
Процентиль: 23%
0.00077
Низкий
7.8 High
CVSS3
Дефекты
NVD-CWE-noinfo
CWE-829