Executive brief
Shiba is a markdown live preview application for developers. A cross-site scripting (XSS) vulnerability in version 1.1.0 allows attackers to inject and execute arbitrary code by crafting malicious markdown input, potentially leading to unauthorized code execution on the user's system.
Technical details
Shiba markdown live preview app version 1.1.0 contains an XSS vulnerability (CWE-79) that leads to code execution because Node.js integration is enabled in the Electron application. The vulnerability is triggered when user-supplied markdown input is not properly sanitized before rendering in the preview. An attacker can craft malicious markdown containing JavaScript payloads that execute with the privileges of the application. Since Node integration is enabled, the injected code gains access to system-level APIs, resulting in remote code execution. The vulnerability was fixed in version 1.1.1.
Affected products
- Shiba Shiba < 1.1.1
Timeline
- 2017-11-25: disclosed: Vulnerability reported via GitHub issue #42
- 2022-05-14: advisory: GitHub Security Advisory GHSA-jr64-pggr-j8xj published
- 2017-12-01: patched: Fixed in version 1.1.1 (commit e8a65b0f81eb04903eedd29500d7e1bedf249eab)