CVE-2019-20374 - A mutation cross-site scripting (XSS) issue in Typora through 0.9.9.31.2 on macOS and through 0.9.81 on Linux leads to Remote Code Execution through Mermaid code blocks

Back Back to CVE browser

CRITICAL

A mutation cross-site scripting (XSS) issue in Typora through 0.9.9.31.2 on macOS and through 0.9.81 on Linux leads to Remote Code Execution through Mermaid code blocks

Published Jan 9, 2020

9.6

CRITICAL

CVSS 3.1

EPSS 2.30%

Description

A mutation cross-site scripting (XSS) issue in Typora through 0.9.9.31.2 on macOS and through 0.9.81 on Linux leads to Remote Code Execution through Mermaid code blocks. To exploit this vulnerability, one must open a file in Typora. The XSS vulnerability is then triggered due to improper HTML sanitization. Given that the application is based on the Electron framework, the XSS leads to remote code execution in an unsandboxed environment.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (2)

https://github.com/cure53/DOMPurify/commit/4e8af7b2c4a159b683d317e02c5cbddb86dc4a0e
x_refsource_MISCPatchThird Party Advisory
https://github.com/typora/typora-issues/issues/3124
x_refsource_MISCThird Party Advisory

Link	Providers	Tags
https://github.com/cure53/DOMPurify/commit/4e8af7b2c4a159b683d317e02c5cbddb86dc4a0e		x_refsource_MISCPatchThird Party Advisory
https://github.com/typora/typora-issues/issues/3124		x_refsource_MISCThird Party Advisory