Description
A vulnerability has been found in MarkText up to 0.17.1 and classified as problematic. Affected by this vulnerability is the function getRecommendTitleFromMarkdownString of the file marktext/src/main/utils/index.js. The manipulation leads to inefficient regular expression complexity. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | MarkText | 0.17.0, 0.17.1 | — |
References
- VDB-313609 | MarkText index.js getRecommendTitleFromMarkdownString redos vdb-entry technical-description
- VDB-313609 | CTI Indicators (IOB, IOC, TTP, IOA) signature permissions-required
- Submit #598208 | marktext 0.17.1 Inefficient Regular Expression Complexity third-party-advisory
- https://github.com/marktext/marktext/pull/3952 issue-tracking
- https://github.com/mmmsssttt404/marktext/blob/c59b3ad423dfa082869933baf9f5d5c69bdcc560/test/unit/specs/match-electron-accelerator.spec.js#L155-L164 exploit