GitHub Advisoryadvisory · npm

GHSA-qqhf-xfhw-7884 Markdownify has Files or Directories Accessible to External Parties

MEDIUM Published 2022-11-04 Modified 2022-11-04 Official page ↗
Aliases
CVE-2022-41710
Ecosystem
npm
Packages
electron-markdownify
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Weaknesses
CWE-552
Reviewed
2022-11-04

Affected packages

• npm electron-markdownify: <= 1.4.1 (no fix yet)

Description

Markdownify version 1.4.1 allows an external attacker to remotely obtain arbitrary local files on any client that attempts to view a malicious markdown file through Markdownify. This is possible because the application does not have a CSP policy (or at least not strict enough) and/or does not properly validate the contents of markdown files before rendering them.

Related

Alias · CVE (1)

  • CVE-2022-41710 Markdownify version 1.4.1 allows an external attacker to remotely obtain arbitrary local files on any client that attempts to view a… vulnerability

Weakness · CWE (1)

  • CWE-552 Files or Directories Accessible to External Parties weakness

References