typora up to and including 0.9.64 has XSS, with resultant remote command execution, during inline rendering of a mathematical formula.
typora typora