Description
Caret is vulnerable to an XSS attack when the user opens a crafted Markdown file when preview mode is enabled. This directly leads to client-side code execution.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| careteditor | caret | — | — |
High · 7.5
CVE-2022-42967
EUVD-2022-46019GHSA-9852-mg56-6j5x
XSS in Caret markdown editor leads to remote code execution when viewing crafted Markdown files
Published Jan 11, 2023 · Updated Apr 8, 2025 · Assigned by JFROG