Unscored CVE-2021-20745 EUVD-2021-8159GHSA-fgmm-f4rh-2m84

Inkdrop versions prior to v5.3.1 allows an attacker to execute arbitrary OS commands on the system where it runs by loading a file or code …

Published Jun 28, 2021 · Updated Aug 3, 2024 · Assigned by jpcert

Vendor: Takuya Matsuyama Product: Inkdrop

Description

Inkdrop versions prior to v5.3.1 allows an attacker to execute arbitrary OS commands on the system where it runs by loading a file or code snippet containing an invalid iframe into Inkdrop.

Affected products

Vendor	Product	Affected	Fixed
Takuya Matsuyama	Inkdrop	versions prior to v5.3.1	—

References

https://www.inkdrop.app/
https://docs.inkdrop.app/releases/5.3.1
https://jvn.jp/en/jp/JVN29949691/index.html