MarkText up to and including 0.16.3 does not sanitize the input of a mermaid block before rendering. This could lead to Remote Code Execution via a .md file containing a mutation Cross-Site Scripting (XSS) payload.
Vulnerable Product | Search on Vulmon | Subscribe to Product |
---|---|---|
marktext marktext |