CVE-2020-16608
CRITICALNotable 1.8.4 - Stored Cross-Site Scripting via Markdown Text
Title source: llmDescription
Notable 1.8.4 allows XSS via crafted Markdown text, with resultant remote code execution (because nodeIntegration in webPreferences is true).
References (2)
Core 2
Core References
Exploit, Third Party Advisory x_refsource_misc
https://sghosh2402.medium.com/cve-2020-16608-8cdad9f4d9b4
Scores
CVSS v3
9.6
EPSS
0.0434
EPSS Percentile
90.1%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Details
CWE
CWE-79
Status
published
Products (1)
notable/notable
1.8.4
Published
Dec 10, 2020
Tracked Since
Feb 18, 2026