Executive brief
Markdownify is an Electron-based desktop application for viewing and editing markdown files. A flaw in the application's security configuration allows arbitrary code execution when a user opens a specially crafted malicious markdown file, potentially compromising the user's system and data.
Technical details
Markdownify 1.4.1 is vulnerable to remote code execution due to the enabled "nodeIntegration" option in the Electron framework. This setting allows markdown content to execute arbitrary Node.js code with the privileges of the Electron process. The vulnerability is triggered when a user opens a malicious markdown file through the application. An attacker can craft a markdown file containing embedded code that will execute when rendered. No patch has been released and no workarounds are documented.
Affected products
- Amit Merchant Markdownify up to 1.4.1
Timeline
- 2022-10-19: disclosed
- 2022-10-25: other: GitHub security team reviewed advisory