Cross Site Scripting Vulnerability in Markdown Editor of Typora
CVE-2023-39703

6.1MEDIUM

Key Information:

Vendor

Typora

Status
Typora
Vendor
CVE Published:
1 September 2023

What is CVE-2023-39703?

A cross site scripting (XSS) vulnerability exists in the Markdown Editor component of Typora version 1.6.7. This flaw allows attackers to upload specially crafted Markdown files, potentially enabling them to execute arbitrary code within the application. Users of Typora should be aware of this risk and ensure that they are using the latest versions of the software.

References

https://c0olw.github.io/2023/07/31/Typora-XSS-Vulnerability/

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.