CVE-2020-16608

Notable 1.8.4 allows XSS via crafted Markdown text, with resultant remote code execution (because nodeIntegration in webPreferences is true).

CVSS v3.1

9.6 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

CVSS v2.0

9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C

EPSS

4.34% chance of exploitation in the next 30 days, 91th percentile

Published

2020-12-10

Updated

2024-08-04

Proof-of-concept exploits (1)

• https://sghosh2402.medium.com/cve-2020-16608-8cdad9f4d9b4

References

• CVE Record
• NVD entry

Related

• CVE-2020-16602
• CVE-2020-16630
• CVE-2020-16599
• CVE-2020-16846
• CVE-2020-16593
• CVE-2020-16875