CVE-2023-2318

DOM-based XSS in src/muya/lib/contentState/pasteCtrl.js in MarkText 0.17.1 and before on Windows, Linux and macOS allows arbitrary JavaScript code to run in the context of MarkText main window. This vulnerability can be exploited if a user copies text from a malicious webpage and paste it into MarkText.

CVSS v3.1

9.6 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

CVSS v3.1

8.6 HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

EPSS

0.54% chance of exploitation in the next 30 days, 43th percentile

Published

2023-08-19

Updated

2024-10-07

Proof-of-concept exploits (2)

• marktext/marktext/issues/3618
• https://starlabs.sg/advisories/23/23-2318/

References

• CVE Record
• NVD entry

Related

• CVE-2020-27176
• CVE-2021-29996
• CVE-2023-1004
• CVE-2023-2317
• CVE-2023-23192
• CVE-2023-23169