CVE-2023-2318

MarkText DOM-Based Cross-site Scripting leading to Remote Code Execution

DOM-based XSS in src/muya/lib/contentState/pasteCtrl.js in MarkText 0.17.1 and before on Windows, Linux and macOS allows arbitrary JavaScript code to run in the context of MarkText main window. This vulnerability can be exploited if a user copies text from a malicious webpage and paste it into MarkText.

Affected

MarkText

CVSS v3.1 NVD

9.6 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

CVSS v3.1 STARLABS

8.6 HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

EPSS

0.54% chance of exploitation in the next 30 days, 44th percentile

Published

2023-08-19

Updated

2024-10-07

Proof-of-concept exploits (2)

• marktext/marktext/issues/361862644★ · 2026-10-15
• https://starlabs.sg/advisories/23/23-2318/

Security advisories

• https://starlabs.sg/advisories/23/23-2318

References

• CVE Record
• NVD entry

Related

• CVE-2020-27176
• CVE-2021-29996
• CVE-2023-1004