Arbitrary Code Execution in Codigo Markdown Editor from Alfonzm
CVE-2023-53940

8.4HIGH

Key Information:

Vendor

Alfonzm

Status
Codigo Markdown Editor
Vendor
CVE Published:
18 December 2025

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2023-53940?

The Codigo Markdown Editor version 1.0.1 is prone to a vulnerability that allows for arbitrary code execution. This vulnerability is exploited by crafting a malicious markdown file containing an embedded video source with an 'onerror' event. When the file is opened, it triggers the execution of shell commands through the Node.js child_process module. This design flaw could allow attackers to execute arbitrary system commands, posing a significant security risk to users.

Affected Version(s)

Codigo Markdown Editor 1.0.1

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2023-53940 - Proof of Concept

References

https://www.exploit-db.com/exploits/51432
exploit
https://github.com/alfonzm/codigo-app
product
https://www.vulncheck.com/advisories/codigo-markdown-edit...
third-party-advisory

CVSS V4

Score:
8.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

8bitsec
JSON
.
CVE-2023-53940 : Arbitrary Code Execution in Codigo Markdown Editor from Alfonzm