Executive brief
Marky is a markdown editor used to view and edit text files. A security flaw allows attackers to embed malicious code within markdown (.md) files. If a user opens a specially crafted file, the attacker could potentially take control of the user's computer or steal sensitive information.
Technical details
A persistent cross-site scripting (XSS) vulnerability exists in Marky 0.0.1 due to improper neutralization of input during markdown rendering (CWE-79). The application allows users to store or upload .md files containing malicious JavaScript payloads. Because the editor is built using Electron and React, these payloads can execute with elevated privileges when the file is opened. An attacker can exploit this to achieve remote code execution (RCE) on the host system, as demonstrated by PoCs using Node.js 'child_process' to execute system commands. The repository for this project was archived in 2019 and no patch is currently available.
Affected products
- vesparny Marky 0.0.1
Timeline
- 2021-05-05: disclosed: Exploit published on Exploit-DB
- 2026-01-16: advisory: CVE published and NVD record created
References
- https://github.com/vesparny/marky
- https://imgur.com/a/qclfrUx
- https://www.exploit-db.com/exploits/49831
- https://www.vulncheck.com/advisories/marky-persistent-cross-site-scripting
- https://access.redhat.com/security/cve/CVE-2021-47839
- https://bugzilla.redhat.com/show_bug.cgi?id=2430451
- https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-47839.json