npm electron-markdownify vulnerabilities

Latest npm electron-markdownify CVEs

Newest publication first

1. CVE-2022-41710 Markdownify has Files or Directories Accessible to External Parties

   Published 2022-11-03

   Medium·CVSS 5.5 EPSS 0.39%

   Markdownify version 1.4.1 allows an external attacker to remotely obtain arbitrary local files on any client that attempts to view a malicious markdown file through Markdownify. This is possible because the application does not have a CSP policy (or at least not strict enough) an...

2. CVE-2022-41709 Markdownify subject to Remote Code Execution via malicious markdown file

   Published 2022-10-19

   High·CVSS 7.8 EPSS 0.48%

   Markdownify version 1.4.1 allows an external attacker to execute arbitrary code remotely on any client attempting to view a malicious markdown file through Markdownify. This is possible because the application has the "nodeIntegration" option enabled.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.