Unscored CVE-2022-21158 EUVD-2022-26403GHSA-xfpv-q4q6-7j43

A stored cross-site scripting vulnerability in marktext versions prior to v0.17.0 due to improper handling of the link (with javascript: sc…

Published Mar 7, 2022 · Updated Aug 3, 2024 · Assigned by jpcert

Description

A stored cross-site scripting vulnerability in marktext versions prior to v0.17.0 due to improper handling of the link (with javascript: scheme) inside the document may allow an attacker to execute an arbitrary script on the PC of the user using marktext.

Affected products

Vendor	Product	Affected	Fixed
MarkText	MarkText	versions prior to v0.17.0	—

References

https://github.com/marktext/marktext/releases/tag/v0.17.0
https://jvn.jp/en/jp/JVN89524240/index.html