Cross-site Scripting in vmd

Description

vmd through 1.34.0 allows div class="markdown-body" XSS, as demonstrated by Electron remote code execution via require('child_process').execSync('calc.exe') on Windows and a similar attack on macOS.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 1.34.0

References

• GHSA-pfr3-87q3-65rc
• www.npmjs.com
• CVE-2021-33041
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Joplin Cross Site Scripting Vulnerability via NOSCRIPT tags - CVE-2021-33295
• vditor Vulnerable to Cross-site Scripting in SVG events - CVE-2021-4103
• Cross-site Scripting in Mermaid - CVE-2021-35513
• Cross-site Scripting in quill - CVE-2021-3163

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

vmd