CVE-2019-20374

CRITICAL

Typora < 0.9.81 - XSS

Title source: rule
STIX 2.1

Description

A mutation cross-site scripting (XSS) issue in Typora through 0.9.9.31.2 on macOS and through 0.9.81 on Linux leads to Remote Code Execution through Mermaid code blocks. To exploit this vulnerability, one must open a file in Typora. The XSS vulnerability is then triggered due to improper HTML sanitization. Given that the application is based on the Electron framework, the XSS leads to remote code execution in an unsandboxed environment.

References (2)

Core 2

Scores

CVSS v3 9.6
EPSS 0.0217
EPSS Percentile 84.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Details

CWE
CWE-79
Status published
Products (1)
typora/typora < 0.9.81
Published Jan 09, 2020
Tracked Since Feb 18, 2026