CVE-2022-41710

Published: Nov 3, 2022Modified: Jun 17, 2026

5.5

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Exploitability: 1.8 / Impact: 3.6

Source: NVD

Description

Markdownify version 1.4.1 allows an external attacker to remotely obtain arbitrary local files on any client that attempts to view a malicious markdown file through Markdownify. This is possible because the application does not have a CSP policy (or at least not strict enough) and/or does not properly validate the contents of markdown files before rendering them.

Affected (1)

Products: Markdownify Project: Markdownify

Markdownify Project

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Markdownify Project Markdownify	Version 1.4.1

Related CWEs

Files or Directories Accessible to External Parties

The product makes files or directories accessible to unauthorized actors, even though they should not be.

References (4)

https://fluidattacks.com/advisories/noisestorm/

Source: help@fluidattacks.com

ExploitThird Party Advisory

https://github.com/amitmerchant1990/electron-markdownify

Source: help@fluidattacks.com

ProductThird Party Advisory

https://fluidattacks.com/advisories/noisestorm/

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://github.com/amitmerchant1990/electron-markdownify

Source: af854a3a-2127-422b-91ae-364da2661108

ProductThird Party Advisory

Timeline

No history available yet.