Executive brief
vmd is a markdown viewer that displays files in an Electron-based desktop application. The tool fails to properly sanitize HTML content when rendering markdown files, allowing an attacker to craft a malicious markdown file that executes arbitrary code on a victim's machine when opened, including command execution via Electron's Node.js access.
Technical details
This is a cross-site scripting (CWE-79) vulnerability in vmd versions through 1.34.0, where unsanitized markdown content is rendered directly into a div with class="markdown-body" without proper HTML escaping. An attacker can embed JavaScript event handlers (e.g., onerror, onmouseover) in HTML tags within a markdown file. When a victim opens the crafted .md file using vmd, the JavaScript executes in the Electron application's context, which has access to Node.js APIs. This allows remote code execution via constructs like require('child_process').execSync() to launch arbitrary system commands on Windows and macOS. The attack requires user interaction (opening a malicious markdown file) and network access to deliver the file. Patches should sanitize or strip HTML from markdown rendering.
Affected products
- vmd vmd through 1.34.0
Timeline
- 2021-05-17: disclosed: Vulnerability reported on GitHub
- 2022-02-10: advisory: GHSA-pfr3-87q3-65rc published
- 2021-05-19: other: GitHub advisory review completed