Cross-site Scripting in vmd

Description

vmd through 1.34.0 allows div class="markdown-body" XSS, as demonstrated by Electron remote code execution via require('child_process').execSync('calc.exe') on Windows and a similar attack on macOS.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 1.34.0

References

• GHSA-pfr3-87q3-65rc
• www.npmjs.com
• CVE-2021-33041
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Denial of Service in jquery - CVE-2016-10707
• gifplayer XSS vulnerability - CVE-2025-31128
• Prototype pollution in gsap - CVE-2020-28478
• pym.js CSRF Vulnerability - CVE-2018-1000086

Tags:

npm

vmd