typora up to and including 0.9.63 has XSS, with resultant remote command execution, during block rendering of a mathematical formula.
typora typora