XSS Vulnerability in Typora Product by Typora Team
CVE-2019-7295

6.1MEDIUM

Key Information:

Vendor

Typora

Status
Typora
Vendor
CVE Published:
31 January 2019

What is CVE-2019-7295?

Typora, a popular markdown editor, is vulnerable to Cross-Site Scripting (XSS) attacks resulting in potential remote command execution. This vulnerability occurs during the block rendering of mathematical formulas, allowing attackers to inject malicious scripts that may execute in the context of the user's session. Users of Typora versions earlier than 0.9.63 are particularly at risk, highlighting the importance of regular software updates and vigilance against suspicious content.

References

https://github.com/typora/typora-issues/issues/2129
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability Reserved

  • Vulnerability published

JSON
.