MarkText DOM-Based Cross-site Scripting leading to Remote Code Execution
CVE-2023-2318

8.6HIGH

Key Information:

Vendor

Marktext

Status
Marktext
Vendor
CVE Published:
19 August 2023

What is CVE-2023-2318?

A DOM-based XSS vulnerability exists in MarkText due to improper handling of copied content. Specifically, in the file src/muya/lib/contentState/pasteCtrl.js, users can inadvertently execute arbitrary JavaScript code if they paste text from a compromised webpage into the MarkText editor. This flaw allows an attacker to manipulate the MarkText environment, potentially leading to unauthorized data access or other malicious activities.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

MarkText Windows 0 <= 0.17.1

References

https://github.com/marktext/marktext/issues/3618
issue-tracking
https://starlabs.sg/advisories/23/23-2318/
third-party-advisory

CVSS V3.1

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Li Jiantao (@CurseRed) of STAR Labs SG Pte. Ltd. (@starlabs_sg)
JSON
.