CVEvulnerability

CVE-2022-25224

5.4 MEDIUM Published 2022-05-20 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-05-20
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.4 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0 ([email protected])
3.5 LOW — AV:N/AC:M/Au:S/C:N/I:P/A:N
Weaknesses
CWE-79

Description

Proton v0.2.0 allows an attacker to create a malicious link inside a markdown file. When the victim clicks the link, the application opens the site in the current frame allowing an attacker to host JavaScript code in the malicious link in order to trigger an XSS attack. The 'nodeIntegration' configuration is set to on which allows the 'webpage' to use 'NodeJs' features, an attacker can leverage this to run OS commands.

Affected configurations

• proton project proton 0.2.0

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References