Unscored CVE-2019-12172 EUVD-2019-3821GHSA-j8m6-hgfm-cp2q

Typora 0.9.9.21.1 (1913) allows arbitrary code execution via a modified file: URL syntax in the HREF attribute of an AREA element, as demon…

Published May 17, 2019 · Updated Aug 4, 2024 · Assigned by mitre

Description

Typora 0.9.9.21.1 (1913) allows arbitrary code execution via a modified file: URL syntax in the HREF attribute of an AREA element, as demonstrated by file:\\\ on macOS or Linux, or file://C| on Windows. This is different from CVE-2019-12137.

References

https://github.com/typora/typora-issues/issues/2166